Skip to content
Sign up

flagon-io/g1t

public
0

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
1,354 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Project settings say who created the project, by name1//! The OpenAPI document, generated from the same list the routes are.
2//!
3//! The docs site builds its API reference from a copy of this document,
4//! `apps/docs/src/data/openapi.json`. A test keeps the copy current: run
5//! `G1T_WRITE_OPENAPI=1 cargo test -p g1t-api openapi` to rewrite it.
6
7use g1t_contracts::scopes::scope_for;
8use serde_json::{Map, Value, json};
9
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9710use crate::about::AboutOp;
The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook.11use crate::run_artifacts::ArtifactsOp;
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.12use crate::archives::ArchiveOp;
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca13use crate::deploy_keys::DeployKeysOp;
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9714use crate::deployments::DeploymentsOp;
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.15use crate::telemetry::TelemetryOp;
Merge packages: roles, Actions access, source label, soft delete, API16use crate::packages::PackagesOp;
Merge main into Artifacts Phase 217use crate::folios::FoliosOp;
Merge branch 'worktree-agent-a3abfcce648e87dca'18use crate::protection::ProtectionOp;
API and MCP for a workspace's personal access token rules, members' tokens and approvals19use crate::token_policy::TokenOp;
Project settings say who created the project, by name20use crate::operations::Op;
Merge checks: statuses and check runs on every commit21use crate::checks::ChecksOp;
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge22use crate::rules::RulesOp;
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar23use crate::security::SecurityOp;
Project settings say who created the project, by name24use crate::rest::{ROUTES, Route};
25
26/// The sections of the API reference: a name, what it covers, and its
27/// operations in the order a reader meets them.
28const SECTIONS: &[(&str, &str, &[Op])] = &[
29 (
30 "Accounts",
31 "Signing in from a tool, who a token acts as, and your email addresses.",
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)32 &[Op::Whoami, Op::ListEmails, Op::AddEmail, Op::ConfirmEmail, Op::RemoveEmail, Op::UpdateEmailSettings],
Project settings say who created the project, by name33 ),
34 (
API: notifications over REST and MCP, with notifications scopes35 "Notifications",
36 "Your inbox: a thread for each thing you were told about (an issue, a pull request, a workflow on a branch, a deployment), why you were told, and what you subscribe to and watch. Your own: personal tokens and sessions only.",
37 &[
38 Op::ListNotifications,
39 Op::MarkNotificationsRead,
40 Op::GetNotificationThread,
41 Op::MarkThreadRead,
42 Op::MarkThreadDone,
43 Op::SaveThread,
44 Op::SnoozeThread,
45 Op::GetThreadSubscription,
46 Op::SetThreadSubscription,
47 Op::DeleteThreadSubscription,
48 Op::GetRepoSubscription,
49 Op::SetRepoSubscription,
50 Op::DeleteRepoSubscription,
51 Op::ListWatchedRepos,
52 ],
53 ),
54 (
API: pinned projects over REST and MCP55 "Pinned projects",
56 "The projects you keep at the top of a workspace's sidebar, in your order, up to eight a workspace. Your own: personal tokens and sessions only.",
57 &[Op::ListPinnedProjects, Op::PinProject, Op::UnpinProject, Op::ReorderPinnedProjects],
58 ),
59 (
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9760 "Projects",
61 "A project is what a workspace builds and runs, from a repository or a root directory in one. Each says what it is, where it runs and where to find it: its homepage, docs and other links.",
62 &[Op::ListProjects, Op::GetProject, Op::UpdateProject],
63 ),
64 (
Project settings say who created the project, by name65 "Workspaces",
66 "A workspace owns repositories and is the first part of their address. People and agents work in workspaces.",
Merge branch 'worktree-agent-ad7c6d88d93adc817'67 &[Op::GetWorkspace, Op::CreateWorkspace, Op::UpdateWorkspace, Op::DeleteWorkspace],
Project settings say who created the project, by name68 ),
69 (
API and MCP for a workspace's personal access token rules, members' tokens and approvals70 "Personal access tokens",
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers71 "A workspace's rules for its members' personal access tokens: whether tokens made for all of a member's workspaces reach it, whether tokens may be made for it alone and wait for an owner's approval, and how long a token may last; the tokens that reach it, approving or denying the ones that wait, and revoking one there. Owners only, as people.",
API and MCP for a workspace's personal access token rules, members' tokens and approvals72 &[
73 Op::Tokens(TokenOp::GetTokenPolicy),
74 Op::Tokens(TokenOp::SetTokenPolicy),
75 Op::Tokens(TokenOp::ListMemberTokens),
76 Op::Tokens(TokenOp::ListTokenRequests),
77 Op::Tokens(TokenOp::ReviewTokenRequest),
78 Op::Tokens(TokenOp::RevokeMemberToken),
79 ],
80 ),
81 (
Merge main (membership, two-factor, GitHub repo roles) into tokens82 "Members",
83 "A workspace's members and owners: who belongs to it, their roles (owner or member, with billing manager and security manager on top), handing it to another member, and leaving it.",
84 &[Op::ListMembers, Op::UpdateMember, Op::RemoveMember, Op::TransferOwnership, Op::LeaveWorkspace],
85 ),
86 (
Project settings say who created the project, by name87 "Invites",
Merge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.88 "Inviting people into a workspace by username or email, and answering the invitations to workspaces sent to you.",
Project settings say who created the project, by name89 &[
90 Op::ListWorkspaceInvites,
91 Op::InviteMember,
92 Op::RevokeWorkspaceInvite,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)93 Op::ListInvitations,
94 Op::AcceptInvitation,
95 Op::DeclineInvitation,
Project settings say who created the project, by name96 ],
97 ),
98 (
Usage, Billing settings and prepaid AI credit; fixes from the UX audit99 "Billing",
Billing, integrations, security and identity no longer serve g1t's own agents. Billing stops metering agent runs, model tokens and AI Gateway requests, drops its model catalogue and price-keeper model prices, and stops selling AI credit, which only ever paid for those; credit bought earlier still pays toward what is owed. A usage report, statement or invoice that holds an old agent or model meter shows it as "Other usage" rather than failing, and the get_ai_credit and buy_ai_credit API operations and MCP billing actions go. Integrations no longer connects model providers or routes models, and no longer assigns imported issues or alerts to g1t; a model provider already connected can still be disconnected. Security drops "Fix with g1t". Identity no longer creates agent tokens or puts agents on teams, a team's lead is a person, and run credentials are issued only for checks, the merge queue, merge checks, deployments and bumps; tokens and credentials already issued keep working until they expire. The reserved names g1t and g1t-agent stay reserved. No tables are dropped.100 "A workspace's usage, its budget and its invoices. Members read them; owners change the budget, as people. A run's token never changes billing.",
Usage, Billing settings and prepaid AI credit; fixes from the UX audit101 &[
102 Op::GetUsage,
103 Op::GetBudget,
104 Op::SetBudget,
105 Op::ListInvoices,
106 Op::GetBillingDetails,
107 ],
108 ),
109 (
Project settings say who created the project, by name110 "Repositories",
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.111 "A repository, how it handles pull requests, and its timeline: renaming, archiving, moving and deleting it; and its files at a branch, tag or commit as a tarball or zipball.",
Project settings say who created the project, by name112 &[
113 Op::ListRepos,
114 Op::CreateRepo,
115 Op::GetRepo,
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.116 Op::Archives(ArchiveOp::DownloadTarball),
117 Op::Archives(ArchiveOp::DownloadZipball),
Project settings say who created the project, by name118 Op::UpdateRepo,
119 Op::RenameRepo,
120 Op::RenameBranch,
The Branches page does things to branches now. It has tabs (Overview, Yours, Active, Stale, All, kept in the address as ?tab=) and search; Overview shows the default branch, then the first five of your branches, the active ones and the stale ones, each linking to the rest. Each branch is a row with its name in a code chip with a copy button, who made its latest commit and when, that commit's checks, behind and ahead counts with bars drawn against the largest shown, and its pull request (the open one, else the newest merged or closed) with its state; on a phone the columns fold under the name. Yours is branches whose latest commit is the viewer's; stale is no commit in 90 days.121 Op::CreateBranch,
122 Op::DeleteBranch,
Project settings say who created the project, by name123 Op::SetRepoVisibility,
124 Op::ArchiveRepo,
125 Op::UnarchiveRepo,
126 Op::TransferRepo,
127 Op::DeleteRepo,
128 Op::ListDeletedRepos,
129 Op::RestoreRepo,
130 Op::PurgeRepo,
131 Op::GetRepoSettings,
132 Op::UpdateRepoSettings,
133 Op::ListCheckNames,
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar134 Op::GetCodeownersErrors,
Project settings say who created the project, by name135 Op::ListEvents,
136 ],
137 ),
138 (
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97139 "Repository insights",
140 "What a repository's default branch says about it, read in the background and kept by commit: the languages it is written in, who made it, and its license.",
141 &[Op::About(AboutOp::GetLanguages), Op::About(AboutOp::ListContributors), Op::About(AboutOp::GetLicense)],
142 ),
143 (
144 "Stars",
145 "Starring a repository, to keep it and to say you like it: who starred one, and what you starred.",
146 &[
147 Op::About(AboutOp::ListStargazers),
148 Op::About(AboutOp::ListStarred),
149 Op::About(AboutOp::CheckStarred),
150 Op::About(AboutOp::Star),
151 Op::About(AboutOp::Unstar),
152 ],
153 ),
154 (
155 "Releases",
156 "A release is a tag published with a title and notes. The latest is the newest published one that is neither a draft nor a prerelease.",
157 &[
158 Op::About(AboutOp::ListReleases),
159 Op::About(AboutOp::CreateRelease),
160 Op::About(AboutOp::GetLatestRelease),
161 Op::About(AboutOp::GetReleaseByTag),
162 Op::About(AboutOp::GetRelease),
163 Op::About(AboutOp::UpdateRelease),
164 Op::About(AboutOp::DeleteRelease),
165 ],
166 ),
167 (
Project settings say who created the project, by name168 "Access",
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca169 "Who can do what in a repository: repository roles, people given a role on one repository (outside collaborators when they are not members), invitations, a workspace's base permission, and deploy keys: SSH keys that reach one repository.",
Project settings say who created the project, by name170 &[
171 Op::ListCollaborators,
172 Op::AddCollaborator,
173 Op::UpdateCollaborator,
174 Op::RemoveCollaborator,
175 Op::GetCollaboratorPermission,
176 Op::ListRepoInvitations,
177 Op::RevokeRepoInvitation,
178 Op::ListMyRepoInvitations,
179 Op::AcceptRepoInvitation,
180 Op::DeclineRepoInvitation,
181 Op::SetBasePermission,
182 Op::ListOutsideCollaborators,
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca183 Op::DeployKeys(DeployKeysOp::ListDeployKeys),
184 Op::DeployKeys(DeployKeysOp::GetDeployKey),
185 Op::DeployKeys(DeployKeysOp::CreateDeployKey),
186 Op::DeployKeys(DeployKeysOp::DeleteDeployKey),
Merge branch 'mirroring' into artifacts-mode187 ],
188 ),
189 (
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar190 "Teams",
191 "Groups of a workspace's members: given a role on repositories together, mentioned together as @workspace/team, and asked to review together. Any member may create a team; the workspace's owners and the team's maintainers manage it.",
192 &[
193 Op::ListTeams,
194 Op::CreateTeam,
195 Op::GetTeam,
196 Op::UpdateTeam,
197 Op::DeleteTeam,
198 Op::ListTeamMembers,
199 Op::SetTeamMember,
200 Op::RemoveTeamMember,
201 Op::ListChildTeams,
202 Op::ListTeamRepos,
203 Op::SetTeamRepo,
204 Op::RemoveTeamRepo,
205 Op::SetTeamReviewAssignment,
206 Op::ListUserTeams,
207 ],
208 ),
209 (
Project settings say who created the project, by name210 "Security",
211 "Secrets found in what is pushed and in a repository's history, and dependencies with known vulnerabilities: listing the alerts, and dismissing or reopening them.",
212 &[Op::ListSecurityAlerts, Op::DismissSecurityAlert, Op::ReopenSecurityAlert],
213 ),
214 (
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar215 "Secret scanning",
216 "Secrets found in pushes and history, where each one is, pushing past push protection with a reason (and asking for approval when the workspace delegates bypasses), checking with a secret's issuer whether it still works, and custom patterns.",
217 &[
218 Op::Security(SecurityOp::ListSecretAlerts),
219 Op::Security(SecurityOp::GetSecretAlert),
220 Op::Security(SecurityOp::UpdateSecretAlert),
221 Op::Security(SecurityOp::ListSecretLocations),
222 Op::Security(SecurityOp::BypassPushProtection),
223 Op::Security(SecurityOp::CheckSecretValidity),
224 Op::Security(SecurityOp::ListBypassRequests),
225 Op::Security(SecurityOp::ReviewBypassRequest),
226 Op::Security(SecurityOp::ListCustomPatterns),
227 Op::Security(SecurityOp::CreateCustomPattern),
228 Op::Security(SecurityOp::UpdateCustomPattern),
229 Op::Security(SecurityOp::DeleteCustomPattern),
230 Op::Security(SecurityOp::DryRunCustomPattern),
231 ],
232 ),
233 (
234 "Code scanning",
235 "Results of static analysis tools, uploaded as SARIF: alerts on the default branch, the analyses that made them, uploads, and putting g1t on an alert to fix it.",
236 &[
237 Op::Security(SecurityOp::ListCodeAlerts),
238 Op::Security(SecurityOp::GetCodeAlert),
239 Op::Security(SecurityOp::UpdateCodeAlert),
240 Op::Security(SecurityOp::ListAnalyses),
241 Op::Security(SecurityOp::UploadSarif),
242 Op::Security(SecurityOp::GetSarifUpload),
243 ],
244 ),
245 (
246 "Supply chain",
247 "What a repository depends on: vulnerability alerts, the dependency graph, an SPDX SBOM of it, and comparing two commits' dependencies as dependency review does.",
248 &[
249 Op::Security(SecurityOp::ListVulnerabilityAlerts),
250 Op::Security(SecurityOp::GetVulnerabilityAlert),
251 Op::Security(SecurityOp::UpdateVulnerabilityAlert),
252 Op::Security(SecurityOp::GetDependencyGraph),
253 Op::Security(SecurityOp::GetSbom),
254 Op::Security(SecurityOp::CompareDependencies),
255 ],
256 ),
257 (
258 "Security settings",
259 "When pull request checks fail, dependency review's policy, delegated bypass and validity checks, and a workspace's security overview.",
260 &[
261 Op::Security(SecurityOp::GetSettings),
262 Op::Security(SecurityOp::UpdateSettings),
263 Op::Security(SecurityOp::GetWorkspaceSettings),
264 Op::Security(SecurityOp::UpdateWorkspaceSettings),
265 Op::Security(SecurityOp::GetOverview),
266 ],
267 ),
268 (
Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9269 "Security advisories",
270 "What a repository says about vulnerabilities in what it ships: advisories drafted, published and withdrawn by its maintainers, and the vulnerability reports people send them privately when the repository takes them.",
271 &[
272 Op::Security(SecurityOp::ListAdvisories),
273 Op::Security(SecurityOp::CreateAdvisory),
274 Op::Security(SecurityOp::GetAdvisory),
275 Op::Security(SecurityOp::UpdateAdvisory),
276 Op::Security(SecurityOp::SetAdvisoryState),
277 Op::Security(SecurityOp::ListReports),
278 Op::Security(SecurityOp::ReportVulnerability),
279 Op::Security(SecurityOp::ReviewReport),
280 ],
281 ),
282 (
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge283 "Rules",
284 "Rulesets: what may happen to a repository's branches and tags and what a pull request needs before it merges, for a repository or across a workspace; the rules that hold for one branch; and how they judged each push and merge, with insights.",
285 &[
286 Op::Rules(RulesOp::ListRepoRulesets),
287 Op::Rules(RulesOp::CreateRepoRuleset),
288 Op::Rules(RulesOp::GetRepoRuleset),
289 Op::Rules(RulesOp::UpdateRepoRuleset),
290 Op::Rules(RulesOp::DeleteRepoRuleset),
291 Op::Rules(RulesOp::GetBranchRules),
292 Op::Rules(RulesOp::ListRuleEvaluations),
293 Op::Rules(RulesOp::ListWorkspaceRulesets),
294 Op::Rules(RulesOp::CreateWorkspaceRuleset),
295 Op::Rules(RulesOp::GetWorkspaceRuleset),
296 Op::Rules(RulesOp::UpdateWorkspaceRuleset),
297 Op::Rules(RulesOp::DeleteWorkspaceRuleset),
298 Op::Rules(RulesOp::ListWorkspaceRuleEvaluations),
299 ],
300 ),
301 (
Merge checks: statuses and check runs on every commit302 "Checks",
303 "What CI, integrations and g1t Actions say about a commit, in the shapes CI tools already send: statuses (a state per context) and check runs (a lifecycle, a conclusion, a Markdown report, annotations on lines and buttons), grouped per reporter into check suites. g1t Actions jobs are check runs too. Required checks are met by either.",
304 &[
305 Op::Checks(ChecksOp::CreateCommitStatus),
306 Op::Checks(ChecksOp::ListCommitStatuses),
307 Op::Checks(ChecksOp::GetCombinedStatus),
308 Op::Checks(ChecksOp::CreateCheckRun),
309 Op::Checks(ChecksOp::UpdateCheckRun),
310 Op::Checks(ChecksOp::GetCheckRun),
311 Op::Checks(ChecksOp::ListCheckRunAnnotations),
312 Op::Checks(ChecksOp::RerequestCheckRun),
313 Op::Checks(ChecksOp::ListCheckRunsForRef),
314 Op::Checks(ChecksOp::ListCheckSuitesForRef),
315 Op::Checks(ChecksOp::GetCheckSuite),
316 Op::Checks(ChecksOp::RerequestCheckSuite),
317 ],
318 ),
319 (
Project settings say who created the project, by name320 "Issues",
321 "What should change in a repository, with labels and comments. Issues and pull requests share one sequence of numbers.",
322 &[
323 Op::ListIssues,
324 Op::CreateIssue,
325 Op::GetIssue,
326 Op::UpdateIssue,
327 Op::CloseIssue,
328 Op::ReopenIssue,
329 Op::AddComment,
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts330 Op::EditComment,
331 Op::DeleteComment,
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar332 Op::ListIssueLabels,
333 Op::AddIssueLabels,
334 Op::SetIssueLabels,
335 Op::RemoveIssueLabels,
336 ],
337 ),
338 (
339 "Labels and milestones",
340 "A repository's labels, which issues and pull requests carry by name, and its milestones, which gather them under a goal and a due date.",
341 &[
Project settings say who created the project, by name342 Op::ListLabels,
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar343 Op::CreateLabel,
344 Op::UpdateLabel,
345 Op::DeleteLabel,
346 Op::AddDefaultLabels,
347 Op::ListMilestones,
348 Op::CreateMilestone,
349 Op::GetMilestone,
350 Op::UpdateMilestone,
351 Op::DeleteMilestone,
Project settings say who created the project, by name352 ],
353 ),
354 (
355 "Pull requests",
356 "A proposed change in its own fork or on a branch. Several can be made for one issue; the one merged resolves it.",
357 &[
358 Op::ListPullRequests,
359 Op::CreatePullRequest,
360 Op::GetPullRequest,
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar361 Op::UpdatePullRequest,
Project settings say who created the project, by name362 Op::GetPullRequestChanges,
363 Op::MarkPullRequestReady,
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts364 Op::ConvertPullRequestToDraft,
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar365 Op::RequestReviewers,
366 Op::RemoveRequestedReviewers,
Project settings say who created the project, by name367 Op::ReviewPullRequest,
368 Op::MergePullRequest,
369 Op::ClosePullRequest,
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts370 Op::ReopenPullRequest,
Project settings say who created the project, by name371 Op::GetMergeQueue,
372 ],
373 ),
374 (
375 "Sessions",
376 "The record of how a pull request was made: prompts, reasoning and the tools that ran.",
377 &[Op::ReadSession, Op::RecordSession],
378 ),
379 (
380 "Memory",
The API and MCP server no longer offer g1t's own agents. g1t is what your coding agents work against, not an agent of its own, so the operations that drove hosted agents are gone: messaging an agent on a pull request (message_agent, take_messages, answer_message), assigning or delegating an issue to g1t (assign_issue, delegate), plans (plan_work, get_plan, apply_plan), the context hub (search_context, get_entity), model routes, agents' computers, AI Gateway requests, "Fix with g1t" on a security alert, and every Customize route (marketplaces, plugins, connectors). The callbacks the agent sandbox reported through (/agent-runs/*, /runs/:id/usage, /plans/:id, /reviews/:id) go with them, update_repo_settings stops accepting agent_review, max_revisions and hold_low_confidence, import_issue stops accepting assign, and an old agent token with no run behind it is refused.381 "What agents and people learned that the next agent should know, for one project or across a workspace. Members only; never a secret.",
Project settings say who created the project, by name382 &[Op::Remember, Op::Recall],
383 ),
384 (
385 "Search",
386 "One search across all of g1t: repositories, code, issues, pull requests, people and workspaces. Public content for everyone, and private content in workspaces you belong to.",
387 &[Op::Search],
388 ),
389 (
390 "Actions",
391 "GitHub Actions workflows in .g1t/workflows, their runs, and their jobs' logs.",
392 &[
393 Op::ListWorkflows,
394 Op::ListWorkflowRuns,
395 Op::GetWorkflowRun,
396 Op::GetJobLogs,
397 Op::DispatchWorkflow,
398 Op::CancelWorkflowRun,
399 Op::RerunWorkflowRun,
400 Op::UpdateWorkflow,
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2401 Op::Artifacts(ArtifactsOp::ListArtifacts),
402 Op::Artifacts(ArtifactsOp::ListRunArtifacts),
403 Op::Artifacts(ArtifactsOp::GetArtifact),
404 Op::Artifacts(ArtifactsOp::DownloadArtifact),
405 Op::Artifacts(ArtifactsOp::DeleteArtifact),
406 Op::Artifacts(ArtifactsOp::GetArtifactRetention),
407 Op::Artifacts(ArtifactsOp::SetArtifactRetention),
Project settings say who created the project, by name408 ],
409 ),
410 (
Merge packages: roles, Actions access, source label, soft delete, API411 "Packages",
412 "A workspace's packages in every registry: their versions and download counts, deleting and restoring them within 30 days, their visibility and repository, the people and teams with a role on them, and which repositories' workflows may use them (Manage Actions access). A package is named by its type and its name, URL-encoded where it holds a slash.",
413 &[
414 Op::Packages(PackagesOp::ListPackages),
415 Op::Packages(PackagesOp::GetPackage),
416 Op::Packages(PackagesOp::UpdatePackage),
417 Op::Packages(PackagesOp::DeletePackage),
418 Op::Packages(PackagesOp::RestorePackage),
419 Op::Packages(PackagesOp::ListVersions),
420 Op::Packages(PackagesOp::GetVersion),
421 Op::Packages(PackagesOp::DeleteVersion),
422 Op::Packages(PackagesOp::RestoreVersion),
423 Op::Packages(PackagesOp::LinkPackage),
424 Op::Packages(PackagesOp::UnlinkPackage),
425 Op::Packages(PackagesOp::ListAccess),
426 Op::Packages(PackagesOp::SetAccess),
427 Op::Packages(PackagesOp::RemoveAccess),
428 Op::Packages(PackagesOp::ListActionsAccess),
429 Op::Packages(PackagesOp::SetActionsAccess),
430 Op::Packages(PackagesOp::RemoveActionsAccess),
431 ],
432 ),
433 (
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97434 "Deployments",
435 "A repository's deployments wherever they run: reported from any CI with these routes, made by g1t Actions jobs with an `environment:`, or built on g1t.page. Each has statuses, shows on its commit as the check `deploy / <environment>`, and belongs to an environment.",
436 &[
437 Op::Deployments(DeploymentsOp::ListDeployments),
438 Op::Deployments(DeploymentsOp::CreateDeployment),
439 Op::Deployments(DeploymentsOp::GetDeployment),
440 Op::Deployments(DeploymentsOp::ListDeploymentStatuses),
441 Op::Deployments(DeploymentsOp::CreateDeploymentStatus),
442 Op::Deployments(DeploymentsOp::ListEnvironments),
443 Op::Deployments(DeploymentsOp::GetEnvironment),
Merge branch 'worktree-agent-a4d35ee70c50683d0' into claude/cool-newton-7nm8r9444 Op::Deployments(DeploymentsOp::StartDeploymentBuild),
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97445 ],
446 ),
447 (
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.448 "Observability",
449 "What a project's running software did: its requests, logs, traces, grouped errors and metrics, from its apps on g1t.page with nothing to set up and from OpenTelemetry (OTLP over HTTP) sent from anywhere with an ingest token. Reading needs a role of your own on the project's repository; resolving errors, Triage; settings, ingest tokens, exports and usage, Admin.",
450 &[
451 Op::Telemetry(TelemetryOp::GetOverview),
452 Op::Telemetry(TelemetryOp::ListRequests),
453 Op::Telemetry(TelemetryOp::GetRequest),
454 Op::Telemetry(TelemetryOp::ListLogs),
455 Op::Telemetry(TelemetryOp::ListTraces),
456 Op::Telemetry(TelemetryOp::GetTrace),
457 Op::Telemetry(TelemetryOp::ListErrors),
458 Op::Telemetry(TelemetryOp::UpdateError),
459 Op::Telemetry(TelemetryOp::ListMetrics),
460 Op::Telemetry(TelemetryOp::GetMetric),
461 Op::Telemetry(TelemetryOp::GetSettings),
462 Op::Telemetry(TelemetryOp::UpdateSettings),
463 Op::Telemetry(TelemetryOp::ListTokens),
464 Op::Telemetry(TelemetryOp::CreateToken),
465 Op::Telemetry(TelemetryOp::DeleteToken),
466 Op::Telemetry(TelemetryOp::ListExports),
467 Op::Telemetry(TelemetryOp::CreateExport),
468 Op::Telemetry(TelemetryOp::UpdateExport),
469 Op::Telemetry(TelemetryOp::DeleteExport),
470 Op::Telemetry(TelemetryOp::GetUsage),
471 ],
472 ),
473 (
Merge branch 'worktree-agent-a3abfcce648e87dca'474 "Run protection",
475 "What keeps workflow runs safe: environments' protection rules (required reviewers, a wait timer, which branches may deploy) and the reviews of the jobs they hold, approving a pull request's run from outside, what a job's token gets when its workflow writes no `permissions:`, and repository_dispatch, which a job's own token may send.",
476 &[
477 Op::Protection(ProtectionOp::UpdateEnvironment),
478 Op::Protection(ProtectionOp::DeleteEnvironment),
479 Op::Protection(ProtectionOp::GetPendingDeployments),
480 Op::Protection(ProtectionOp::ReviewPendingDeployments),
481 Op::Protection(ProtectionOp::ApproveWorkflowRun),
482 Op::Protection(ProtectionOp::GetWorkflowPermissions),
483 Op::Protection(ProtectionOp::SetWorkflowPermissions),
484 Op::Protection(ProtectionOp::GetForkPrApproval),
485 Op::Protection(ProtectionOp::SetForkPrApproval),
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts486 Op::Protection(ProtectionOp::GetActionsAccess),
487 Op::Protection(ProtectionOp::SetActionsAccess),
Merge branch 'worktree-agent-a3abfcce648e87dca'488 Op::Protection(ProtectionOp::CreateRepositoryDispatch),
489 Op::Protection(ProtectionOp::GetWorkspaceWorkflowPermissions),
490 Op::Protection(ProtectionOp::SetWorkspaceWorkflowPermissions),
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.491 Op::Protection(ProtectionOp::ListWorkspaceManagedWorkflows),
492 Op::Protection(ProtectionOp::CreateWorkspaceManagedWorkflow),
493 Op::Protection(ProtectionOp::UpdateWorkspaceManagedWorkflow),
494 Op::Protection(ProtectionOp::DeleteWorkspaceManagedWorkflow),
Merge branch 'worktree-agent-a3abfcce648e87dca'495 ],
496 ),
497 (
Project settings say who created the project, by name498 "Secrets and variables",
499 "Values that workflows and deployments read, per repository or for a whole workspace, with a row per environment.",
500 &[
501 Op::ListActionsSecrets,
502 Op::SetActionsSecret,
503 Op::DeleteActionsSecret,
504 Op::ListActionsVariables,
505 Op::SetActionsVariable,
506 Op::DeleteActionsVariable,
507 ],
508 ),
509 (
510 "Runners",
The API and MCP server no longer offer g1t's own agents. g1t is what your coding agents work against, not an agent of its own, so the operations that drove hosted agents are gone: messaging an agent on a pull request (message_agent, take_messages, answer_message), assigning or delegating an issue to g1t (assign_issue, delegate), plans (plan_work, get_plan, apply_plan), the context hub (search_context, get_entity), model routes, agents' computers, AI Gateway requests, "Fix with g1t" on a security alert, and every Customize route (marketplaces, plugins, connectors). The callbacks the agent sandbox reported through (/agent-runs/*, /runs/:id/usage, /plans/:id, /reviews/:id) go with them, update_repo_settings stops accepting agent_review, max_revisions and hold_low_confidence, import_issue stops accepting assign, and an old agent token with no run behind it is refused.511 "Self-hosted runners: your own machines, which run your workflow jobs for $0 of g1t compute. They register with a short-lived token and only ever connect out.",
Project settings say who created the project, by name512 &[
513 Op::ListRunners,
514 Op::CreateRunnerRegistrationToken,
515 Op::RemoveRunner,
516 Op::ListRunnerGroups,
517 Op::CreateRunnerGroup,
518 Op::UpdateRunnerGroup,
519 Op::DeleteRunnerGroup,
520 Op::GetRunnerSettings,
521 Op::UpdateRunnerSettings,
Every agent can have its own computer. A session that needs one wakes it: a home of its own on g1t cloud, one per agent and never shared, where it runs commands, reads and writes files and keeps what it made, with each session working in its own folder under a shared home; after ten idle minutes it sleeps, its home kept as a snapshot and restored when it wakes, and Reset wipes the home while memory and artifacts stay. Its shell and files are abilities with the usual choices, Alone, Alone when asked, Ask first or Never, offered only inside sessions and never to a chat reply; every command shows on the session with its output, and the agent's new Computer tab shows the state, the disk used of the five gigabytes included, the recent commands, and Wake, Put to sleep and Reset. Machine time counts only while it is awake, on the sandbox lines of the ledger that name the agent and who asked, held to the same spend caps as the session; the disk itself costs nothing in this version. The runner gained a long-lived supervisor that answers the computer's requests inside the container, and the runner service a computer per agent that keeps its snapshot in the agent homes bucket when one is attached, and says so when none is. The REST API and the agent tool can read a computer, wake it, put it to sleep and reset it. The agents, abilities, sessions, runners, billing and deploy guides say how it works and what an operator sets up; pinning a computer to your own runner, its browser and take-over come next.522 ],
523 ),
524 (
Project settings say who created the project, by name525 "Webhooks",
526 "Signed HTTPS requests sent to your own address as things happen, for a repository or a whole workspace.",
527 &[
528 Op::ListWebhooks,
529 Op::CreateWebhook,
530 Op::UpdateWebhook,
531 Op::DeleteWebhook,
532 Op::PingWebhook,
533 Op::ListWebhookDeliveries,
534 Op::RedeliverWebhook,
535 ],
536 ),
537 (
538 "Integrations",
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.539 "A workspace's connections to outside systems: AI providers, alert sources and issue trackers.",
Project settings say who created the project, by name540 &[
541 Op::ListIntegrations,
542 Op::ConnectIntegration,
AI Gateway: OpenAI's format, open models, and your own providers543 Op::UpdateIntegration,
Project settings say who created the project, by name544 Op::DisconnectIntegration,
545 Op::TestIntegration,
546 Op::GetContext,
547 Op::ImportIssue,
Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9548 ],
549 ),
550 (
Merge main into Artifacts Phase 2551 "Artifacts",
552 "A workspace's docs, slides, designs and dashboards (Artifacts mode): listing and searching the ones you can open, reading and editing their content in Markdown, making, moving, trashing and restoring them, their versions, and who can open them. Each answers for your own role on it. Not workflow runs' artifacts, which are under Actions. Slides, designs and dashboards answer that they are not here yet.",
553 &[
554 Op::Folios(FoliosOp::List),
555 Op::Folios(FoliosOp::Search),
556 Op::Folios(FoliosOp::Get),
557 Op::Folios(FoliosOp::GetContent),
558 Op::Folios(FoliosOp::ListVersions),
559 Op::Folios(FoliosOp::GetAccess),
560 Op::Folios(FoliosOp::ListTemplates),
561 Op::Folios(FoliosOp::ListSpaces),
562 Op::Folios(FoliosOp::QueryDataset),
563 Op::Folios(FoliosOp::Create),
564 Op::Folios(FoliosOp::Update),
565 Op::Folios(FoliosOp::Edit),
566 Op::Folios(FoliosOp::Trash),
567 Op::Folios(FoliosOp::Restore),
568 Op::Folios(FoliosOp::RestoreVersion),
569 Op::Folios(FoliosOp::SetAccess),
570 Op::Folios(FoliosOp::Purge),
571 ],
572 ),
Project settings say who created the project, by name573];
574
575/// The section of the API reference an operation is listed under.
576fn tag(op: Op) -> &'static str {
577 SECTIONS
578 .iter()
579 .find(|(_, _, ops)| ops.contains(&op))
580 .map_or("Repositories", |(name, _, _)| name)
581}
582
583/// What an operation's page is called, as a short sentence.
584fn title(op: Op) -> &'static str {
585 match op {
586 Op::Whoami => "Get the current user",
Merge branch 'worktree-agent-ad7c6d88d93adc817'587 Op::GetWorkspace => "Get a workspace",
Project settings say who created the project, by name588 Op::CreateWorkspace => "Create a workspace",
589 Op::DeleteWorkspace => "Delete a workspace",
590 Op::UpdateWorkspace => "Update a workspace",
Merge main (membership, two-factor, GitHub repo roles) into tokens591 Op::ListMembers => "List a workspace's members",
592 Op::UpdateMember => "Change a member's role",
593 Op::RemoveMember => "Remove a member",
594 Op::TransferOwnership => "Transfer a workspace's ownership",
595 Op::LeaveWorkspace => "Leave a workspace",
Project settings say who created the project, by name596 Op::ListEmails => "List your email addresses",
597 Op::AddEmail => "Add an email address",
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)598 Op::ConfirmEmail => "Confirm an email address",
Project settings say who created the project, by name599 Op::RemoveEmail => "Remove an email address",
600 Op::UpdateEmailSettings => "Change your email settings",
601 Op::ListWorkspaceInvites => "List a workspace's invites",
602 Op::InviteMember => "Invite someone to a workspace",
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)603 Op::ListInvitations => "List your workspace invitations",
604 Op::AcceptInvitation => "Accept a workspace invitation",
605 Op::DeclineInvitation => "Decline a workspace invitation",
Project settings say who created the project, by name606 Op::RevokeWorkspaceInvite => "Revoke a workspace's invite",
607 Op::TransferRepo => "Transfer a repository",
608 Op::RenameRepo => "Rename a repository",
609 Op::RenameBranch => "Rename a branch",
The Branches page does things to branches now. It has tabs (Overview, Yours, Active, Stale, All, kept in the address as ?tab=) and search; Overview shows the default branch, then the first five of your branches, the active ones and the stale ones, each linking to the rest. Each branch is a row with its name in a code chip with a copy button, who made its latest commit and when, that commit's checks, behind and ahead counts with bars drawn against the largest shown, and its pull request (the open one, else the newest merged or closed) with its state; on a phone the columns fold under the name. Yours is branches whose latest commit is the viewer's; stale is no commit in 90 days.610 Op::CreateBranch => "Create a branch",
611 Op::DeleteBranch => "Delete a branch",
Project settings say who created the project, by name612 Op::ArchiveRepo => "Archive a repository",
613 Op::UnarchiveRepo => "Unarchive a repository",
614 Op::SetRepoVisibility => "Change a repository's visibility",
615 Op::DeleteRepo => "Delete a repository",
616 Op::ListDeletedRepos => "List recently deleted repositories",
617 Op::RestoreRepo => "Restore a deleted repository",
618 Op::PurgeRepo => "Purge a deleted repository",
619 Op::ListRepos => "List repositories",
620 Op::GetRepo => "Get a repository",
621 Op::CreateRepo => "Create a repository",
622 Op::UpdateRepo => "Update a repository",
623 Op::GetRepoSettings => "Get repository settings",
624 Op::UpdateRepoSettings => "Update repository settings",
625 Op::ListCheckNames => "List check names",
626 Op::GetMergeQueue => "Get the merge queue",
627 Op::Remember => "Remember something",
628 Op::Recall => "Recall memory",
629 Op::Search => "Search g1t",
630 Op::ListIssues => "List issues",
631 Op::GetIssue => "Get an issue",
632 Op::CreateIssue => "Create an issue",
633 Op::UpdateIssue => "Update an issue",
634 Op::CloseIssue => "Close an issue",
635 Op::ReopenIssue => "Reopen an issue",
636 Op::ListLabels => "List labels",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar637 Op::CreateLabel => "Create a label",
638 Op::UpdateLabel => "Update a label",
639 Op::DeleteLabel => "Delete a label",
640 Op::AddDefaultLabels => "Add the default labels",
641 Op::ListIssueLabels => "List an issue's labels",
642 Op::AddIssueLabels => "Add labels to an issue",
643 Op::SetIssueLabels => "Set an issue's labels",
644 Op::RemoveIssueLabels => "Remove labels from an issue",
645 Op::ListMilestones => "List milestones",
646 Op::GetMilestone => "Get a milestone",
647 Op::CreateMilestone => "Create a milestone",
648 Op::UpdateMilestone => "Update a milestone",
649 Op::DeleteMilestone => "Delete a milestone",
650 Op::UpdatePullRequest => "Update a pull request",
Project settings say who created the project, by name651 Op::AddComment => "Add a comment",
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts652 Op::EditComment => "Edit a comment",
653 Op::DeleteComment => "Delete a comment",
Project settings say who created the project, by name654 Op::ReviewPullRequest => "Review a pull request",
655 Op::ListPullRequests => "List pull requests",
656 Op::GetPullRequest => "Get a pull request",
657 Op::CreatePullRequest => "Create a pull request",
658 Op::RecordSession => "Record session entries",
659 Op::ReadSession => "Read a session",
660 Op::MarkPullRequestReady => "Mark a pull request ready",
661 Op::ClosePullRequest => "Close a pull request",
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts662 Op::ReopenPullRequest => "Reopen a pull request",
663 Op::ConvertPullRequestToDraft => "Convert a pull request to a draft",
Project settings say who created the project, by name664 Op::GetPullRequestChanges => "Get a pull request's changes",
665 Op::MergePullRequest => "Merge a pull request",
666 Op::ListEvents => "List repository events",
667 Op::ListIntegrations => "List integrations",
668 Op::ConnectIntegration => "Connect an integration",
AI Gateway: OpenAI's format, open models, and your own providers669 Op::UpdateIntegration => "Update an integration",
Project settings say who created the project, by name670 Op::DisconnectIntegration => "Disconnect an integration",
671 Op::TestIntegration => "Test an integration",
672 Op::GetContext => "Look up a ticket",
673 Op::ImportIssue => "Import an issue",
674 Op::ListWebhooks => "List webhooks",
675 Op::CreateWebhook => "Create a webhook",
676 Op::UpdateWebhook => "Update a webhook",
677 Op::DeleteWebhook => "Delete a webhook",
678 Op::PingWebhook => "Ping a webhook",
679 Op::ListWebhookDeliveries => "List webhook deliveries",
680 Op::RedeliverWebhook => "Redeliver a webhook delivery",
681 Op::ListWorkflows => "List workflows",
682 Op::ListWorkflowRuns => "List workflow runs",
683 Op::GetWorkflowRun => "Get a workflow run",
684 Op::GetJobLogs => "Get a job's log",
685 Op::DispatchWorkflow => "Run a workflow",
686 Op::CancelWorkflowRun => "Cancel a workflow run",
687 Op::RerunWorkflowRun => "Re-run a workflow run",
688 Op::UpdateWorkflow => "Turn a workflow on or off",
689 Op::ListActionsSecrets => "List secrets",
690 Op::SetActionsSecret => "Set a secret",
691 Op::DeleteActionsSecret => "Delete a secret",
692 Op::ListActionsVariables => "List variables",
693 Op::SetActionsVariable => "Set a variable",
694 Op::DeleteActionsVariable => "Delete a variable",
695 Op::ListRunners => "List self-hosted runners",
696 Op::ListRunnerGroups => "List runner groups",
697 Op::GetRunnerSettings => "Get runner settings",
698 Op::CreateRunnerRegistrationToken => "Create a runner registration token",
699 Op::RemoveRunner => "Remove a self-hosted runner",
700 Op::CreateRunnerGroup => "Create a runner group",
701 Op::UpdateRunnerGroup => "Change a runner group",
702 Op::DeleteRunnerGroup => "Delete a runner group",
703 Op::UpdateRunnerSettings => "Change runner settings",
704 Op::ListCollaborators => "List who has access",
705 Op::AddCollaborator => "Add a collaborator",
706 Op::UpdateCollaborator => "Change a collaborator's role",
707 Op::RemoveCollaborator => "Remove a collaborator",
708 Op::GetCollaboratorPermission => "Get someone's permission",
709 Op::ListRepoInvitations => "List a repository's invitations",
710 Op::RevokeRepoInvitation => "Revoke a repository invitation",
711 Op::ListMyRepoInvitations => "List your repository invitations",
712 Op::AcceptRepoInvitation => "Accept a repository invitation",
713 Op::DeclineRepoInvitation => "Decline a repository invitation",
714 Op::SetBasePermission => "Set the base permission",
715 Op::ListOutsideCollaborators => "List outside collaborators",
716 Op::ListSecurityAlerts => "List security alerts",
717 Op::DismissSecurityAlert => "Dismiss a security alert",
718 Op::ReopenSecurityAlert => "Reopen a security alert",
API: notifications over REST and MCP, with notifications scopes719 Op::ListNotifications => "List notifications",
720 Op::MarkNotificationsRead => "Mark notifications read",
721 Op::GetNotificationThread => "Get a thread",
722 Op::MarkThreadRead => "Mark a thread read",
723 Op::MarkThreadDone => "Mark a thread done",
724 Op::SaveThread => "Save a thread",
725 Op::SnoozeThread => "Snooze a thread",
726 Op::GetThreadSubscription => "Get a thread subscription",
727 Op::SetThreadSubscription => "Set a thread subscription",
728 Op::DeleteThreadSubscription => "Unsubscribe from a thread",
729 Op::GetRepoSubscription => "Get how you watch a repository",
730 Op::SetRepoSubscription => "Watch a repository",
731 Op::DeleteRepoSubscription => "Stop watching a repository",
732 Op::ListWatchedRepos => "List repositories you watch",
API: pinned projects over REST and MCP733 Op::ListPinnedProjects => "List your pinned projects",
Usage, Billing settings and prepaid AI credit; fixes from the UX audit734 Op::GetUsage => "Get a workspace's usage",
735 Op::GetBudget => "Get a workspace's budget",
736 Op::SetBudget => "Change a workspace's budget",
737 Op::ListInvoices => "List a workspace's invoices",
738 Op::GetBillingDetails => "Get a workspace's billing details",
API: pinned projects over REST and MCP739 Op::PinProject => "Pin a project",
740 Op::UnpinProject => "Unpin a project",
741 Op::ReorderPinnedProjects => "Reorder your pinned projects",
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97742 Op::ListProjects => "List a workspace's projects",
743 Op::GetProject => "Get a project",
744 Op::UpdateProject => "Update a project",
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar745 Op::ListTeams => "List teams",
746 Op::GetTeam => "Get a team",
747 Op::CreateTeam => "Create a team",
748 Op::UpdateTeam => "Update a team",
749 Op::DeleteTeam => "Delete a team",
750 Op::ListTeamMembers => "List a team's members",
751 Op::SetTeamMember => "Add or change a team member",
752 Op::RemoveTeamMember => "Remove a team member",
753 Op::ListChildTeams => "List child teams",
754 Op::ListTeamRepos => "List a team's repositories",
755 Op::SetTeamRepo => "Give a team a role on a repository",
756 Op::RemoveTeamRepo => "Remove a team from a repository",
757 Op::SetTeamReviewAssignment => "Set a team's review assignment",
758 Op::ListUserTeams => "List someone's teams",
759 Op::RequestReviewers => "Request reviewers",
760 Op::RemoveRequestedReviewers => "Remove requested reviewers",
761 Op::GetCodeownersErrors => "List CODEOWNERS errors",
762 Op::Security(op) => op.title(),
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge763 Op::Rules(op) => op.title(),
Merge checks: statuses and check runs on every commit764 Op::Checks(op) => op.title(),
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97765 Op::About(op) => op.title(),
766 Op::Deployments(op) => op.title(),
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.767 Op::Telemetry(op) => op.title(),
Merge branch 'worktree-agent-a3abfcce648e87dca'768 Op::Protection(op) => op.title(),
API and MCP for a workspace's personal access token rules, members' tokens and approvals769 Op::Tokens(op) => op.title(),
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2770 Op::Artifacts(op) => op.title(),
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.771 Op::Archives(op) => op.title(),
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca772 Op::DeployKeys(op) => op.title(),
Merge packages: roles, Actions access, source label, soft delete, API773 Op::Packages(op) => op.title(),
Merge main into Artifacts Phase 2774 Op::Folios(op) => op.title(),
Project settings say who created the project, by name775 }
776}
777
778/// Why an operation can be refused with `402 payment_required`, if it
The API and MCP server no longer offer g1t's own agents. g1t is what your coding agents work against, not an agent of its own, so the operations that drove hosted agents are gone: messaging an agent on a pull request (message_agent, take_messages, answer_message), assigning or delegating an issue to g1t (assign_issue, delegate), plans (plan_work, get_plan, apply_plan), the context hub (search_context, get_entity), model routes, agents' computers, AI Gateway requests, "Fix with g1t" on a security alert, and every Customize route (marketplaces, plugins, connectors). The callbacks the agent sandbox reported through (/agent-runs/*, /runs/:id/usage, /plans/:id, /reviews/:id) go with them, update_repo_settings stops accepting agent_review, max_revisions and hold_low_confidence, import_issue stops accepting assign, and an old agent token with no run behind it is refused.779/// can: the ones that make a repository private in a workspace, when a
780/// free workspace's private storage has no room for it.
Project settings say who created the project, by name781fn may_need_payment(op: Op) -> Option<&'static str> {
782 match op {
783 Op::UpdateRepo | Op::SetRepoVisibility | Op::TransferRepo => Some(
784 "A free workspace's private storage has no room for this private repository.",
785 ),
786 _ => None,
787 }
788}
789
790/// What the reference says beyond each operation's own description, keyed
791/// by operation id, written by hand from what the services return: `notes`
792/// (Markdown, added to the description) and example `params` (path),
793/// `query`, `request` (body) and `response`.
794const REFERENCE: &str = include_str!("reference.json");
795
796fn examples() -> Map<String, Value> {
797 match serde_json::from_str(REFERENCE) {
798 Ok(Value::Object(examples)) => examples,
799 _ => Map::new(),
800 }
801}
802
803/// `/repos/:owner/:name` as OpenAPI writes it: `/repos/{owner}/{name}`.
804fn openapi_path(route: &Route) -> String {
805 route
806 .path
807 .split('/')
808 .map(|segment| match segment.strip_prefix(':') {
809 Some(name) => format!("{{{name}}}"),
810 None => segment.to_owned(),
811 })
812 .collect::<Vec<_>>()
813 .join("/")
814}
815
816fn error_response(description: &str) -> Value {
817 json!({
818 "description": description,
819 "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } },
820 })
821}
822
823/// A parameter in the path or the query, described by the operation's
824/// input schema where it has the same name.
825fn parameter(name: &str, place: &str, required: bool, schema: Option<&Value>) -> Value {
826 let mut schema = schema.cloned().unwrap_or_else(|| json!({ "type": "string" }));
827 let description = match name {
828 "owner" => Some(Value::from("The workspace that owns the repository.")),
829 "name" => Some(Value::from("The repository's name.")),
830 _ => schema.as_object_mut().and_then(|schema| schema.remove("description")),
831 };
832 let mut parameter = json!({
833 "name": name,
834 "in": place,
835 "required": required,
836 "schema": schema,
837 });
838 if let Some(description) = description {
839 parameter["description"] = description;
840 }
841 parameter
842}
843
844/// The operation id of a route. An operation reached at a workspace's
845/// address as well as a repository's is documented once for each, with its
846/// own id; GitHub's alternative addresses for one operation keep GitHub's
847/// names.
848fn operation_id(route: &Route) -> String {
849 let op = route.op;
850 let base = match (route.method, route.path.rsplit('/').next().unwrap_or_default()) {
851 ("PUT", "enable") => "enable_workflow".to_owned(),
852 ("PUT", "disable") => "disable_workflow".to_owned(),
853 ("POST", "rerun-failed-jobs") => "rerun_failed_jobs".to_owned(),
Merge Actions runs: summaries, attempts and re-runs, graceful cancel, log downloads, badges (actions 0009)854 ("POST", "rerun") if route.path.contains("/jobs/:job/") => "rerun_job".to_owned(),
855 ("POST", "force-cancel") => "force_cancel_workflow_run".to_owned(),
856 ("GET", ":attempt") => "get_workflow_run_attempt".to_owned(),
Project settings say who created the project, by name857 ("PATCH", ":setting") => "update_actions_variable".to_owned(),
858 ("GET", "runs") if route.path.contains("/workflows/:workflow/") => "list_runs_of_workflow".to_owned(),
API: notifications over REST and MCP, with notifications scopes859 // One repository's notifications, and an issue's subscription by
860 // its number rather than a thread's id.
861 (_, "notifications") if route.path.starts_with("/repos/") => match op {
862 Op::ListNotifications => "list_repo_notifications".to_owned(),
863 _ => "mark_repo_notifications_read".to_owned(),
864 },
865 (method, "subscription") if route.path.contains("/issues/:number/") => match method {
866 "GET" => "get_issue_subscription".to_owned(),
867 "PUT" => "set_issue_subscription".to_owned(),
868 _ => "delete_issue_subscription".to_owned(),
869 },
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar870 // One label off an issue, by its name in the path.
871 ("DELETE", ":label") if route.path.contains("/issues/:number/") => "remove_issue_label".to_owned(),
API: notifications over REST and MCP, with notifications scopes872 ("DELETE", "saved") => "unsave_thread".to_owned(),
873 ("DELETE", "snooze") => "unsnooze_thread".to_owned(),
Project settings say who created the project, by name874 _ => op.name().to_owned(),
875 };
876 if route.path.starts_with("/workspaces/") && ROUTES.iter().any(|other| other.op == op && other.path.starts_with("/repos/")) {
877 format!("{base}_for_workspace")
878 } else {
879 base
880 }
881}
882
883/// The summary of a route: its operation's title, or for one of GitHub's
884/// alternative addresses, what that address does.
885fn summary(route: &Route, id: &str) -> String {
886 let base = match id.trim_end_matches("_for_workspace") {
887 "enable_workflow" => "Turn a workflow on",
888 "disable_workflow" => "Turn a workflow off",
889 "rerun_failed_jobs" => "Re-run failed jobs",
Merge Actions runs: summaries, attempts and re-runs, graceful cancel, log downloads, badges (actions 0009)890 "rerun_job" => "Re-run a job",
891 "force_cancel_workflow_run" => "Force-cancel a workflow run",
892 "get_workflow_run_attempt" => "Get a workflow run attempt",
Project settings say who created the project, by name893 "update_actions_variable" => "Update a variable",
894 "list_runs_of_workflow" => "List a workflow's runs",
API: notifications over REST and MCP, with notifications scopes895 "list_repo_notifications" => "List a repository's notifications",
896 "mark_repo_notifications_read" => "Mark a repository's notifications read",
897 "get_issue_subscription" => "Get your subscription to an issue",
898 "set_issue_subscription" => "Subscribe to an issue",
899 "delete_issue_subscription" => "Unsubscribe from an issue",
900 "unsave_thread" => "Unsave a thread",
901 "unsnooze_thread" => "Bring a snoozed thread back",
Project settings say who created the project, by name902 _ => title(route.op),
903 };
904 if id.ends_with("_for_workspace") {
905 format!("{base} for a workspace")
906 } else {
907 base.to_owned()
908 }
909}
910
911fn operation(route: &Route) -> Value {
912 let op = route.op;
913 let path_params: Vec<&str> = route.params().collect();
Merge checks: statuses and check runs on every commit914 // `owner` and `name` in the path stand for the operation's `repo` input,
915 // so a `name` in the body, such as a check run's, is the body's own.
916 let stands_for_repo =
917 |name: &str| matches!(name, "owner" | "name") && path_params.contains(&"owner") && path_params.contains(&"name");
918 let covered = |name: &str| name == "repo" || (path_params.contains(&name) && !stands_for_repo(name));
Project settings say who created the project, by name919 let all_properties = op.properties();
920 let mut properties = all_properties.clone();
921 properties.retain(|name, _| !covered(name));
922 let required: Vec<String> = op
923 .required()
924 .into_iter()
925 .filter(|name| !covered(name))
926 .collect();
927
928 let mut parameters: Vec<Value> = path_params
929 .iter()
Merge checks: statuses and check runs on every commit930 .map(|name| parameter(name, "path", true, if stands_for_repo(name) { None } else { all_properties.get(*name) }))
Project settings say who created the project, by name931 .collect();
932 let mut body = Value::Null;
933 if route.method == "GET" {
934 for (name, key) in route.query {
935 parameters.push(parameter(
936 name,
937 "query",
938 required.iter().any(|required| required == key),
939 properties.get(*key),
940 ));
941 }
942 } else if !properties.is_empty() {
943 let mut schema = json!({ "type": "object", "properties": properties });
944 if !required.is_empty() {
945 schema["required"] = json!(required);
946 }
947 body = json!({
948 "required": !required.is_empty(),
949 "content": { "application/json": { "schema": schema } },
950 });
951 }
952
953 let id = operation_id(route);
954 let mut responses = Map::new();
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts955 if route.no_content() {
956 responses.insert("204".into(), json!({ "description": "Success. There is no body." }));
957 } else {
958 responses.insert(
959 "200".into(),
960 json!({
961 "description": "Success.",
962 "content": { "application/json": { "schema": {} } },
963 }),
964 );
965 }
Project settings say who created the project, by name966 responses.insert(
967 "401".into(),
968 error_response("A token is required, or the one sent is not valid."),
969 );
970 if let Some(reason) = may_need_payment(op) {
971 responses.insert("402".into(), error_response(reason));
972 }
973 responses.insert(
974 "403".into(),
975 error_response("Signed in, but not allowed to do this: the role you have is not enough, or the token lacks the scope it needs, which `needed_scope` names."),
976 );
977 if !matches!(op, Op::Whoami | Op::ListRepos | Op::Search) {
978 responses.insert("404".into(), error_response("It does not exist, or you cannot see it."));
979 }
980 if route.method != "GET" {
981 responses.insert(
982 "409".into(),
983 error_response("The request conflicts with the current state."),
984 );
985 }
986 if op != Op::Whoami {
987 responses.insert("422".into(), error_response("The input is not valid."));
988 }
989 // Public data can be read without a token; everything else needs one.
990 let scope: Vec<&str> = scope_for(op.name()).map(|scope| scope.as_str()).into_iter().collect();
991 let security = if op.needs_user() {
992 json!([{ "token": scope }])
993 } else {
994 json!([{ "token": scope }, {}])
995 };
996 let (tool, action) = crate::tools::TOOLS
997 .iter()
998 .find_map(|tool| {
999 tool.actions
1000 .iter()
1001 .find(|action| action.op == op)
1002 .map(|action| (tool.name, action.name))
1003 })
1004 .unwrap_or_default();
1005 let mut described = json!({
1006 "operationId": id,
1007 "tags": [tag(op)],
1008 "summary": summary(route, &id),
1009 "description": op.description(),
1010 "x-operation": op.name(),
1011 "x-mcp-tool": tool,
1012 "x-mcp-action": action,
1013 "x-scope": scope.first().copied(),
1014 "security": security,
1015 "parameters": parameters,
1016 "responses": responses,
1017 });
1018 if !body.is_null() {
1019 described["requestBody"] = body;
1020 }
1021 described
1022}
1023
1024/// Entries for device sign-in, which is not an operation.
1025fn onboarding() -> Map<String, Value> {
1026 let paths = json!({
1027 "/device/code": {
1028 "post": {
1029 "operationId": "device_code",
1030 "tags": ["Accounts"],
1031 "summary": "Start signing in",
1032 "description": "Begins a device sign-in. Show the person `verification_uri_complete` and have them open it in a browser, where they sign in or register and approve the code. Then poll `/device/token`.",
1033 "security": [],
1034 "requestBody": {
1035 "content": { "application/json": { "schema": {
1036 "type": "object",
1037 "properties": {
1038 "client_name": {
1039 "type": "string",
1040 "description": "What is asking, shown to the person approving. For example, Claude Code.",
1041 },
1042 },
1043 } } },
1044 },
1045 "responses": { "200": {
1046 "description": "The codes for this sign-in.",
1047 "content": { "application/json": { "schema": {
1048 "type": "object",
1049 "properties": {
1050 "device_code": { "type": "string", "description": "Secret. Send it to /device/token." },
1051 "user_code": { "type": "string", "description": "Shown to the person, like WDJB-MJHT." },
1052 "verification_uri": { "type": "string" },
1053 "verification_uri_complete": {
1054 "type": "string",
1055 "description": "The link to give the person; it carries the code.",
1056 },
1057 "expires_in": { "type": "integer", "description": "Seconds until the codes expire." },
1058 "interval": { "type": "integer", "description": "Seconds to wait between polls." },
1059 },
1060 } } },
1061 } },
1062 },
1063 },
1064 "/device/token": {
1065 "post": {
1066 "operationId": "device_token",
1067 "tags": ["Accounts"],
1068 "summary": "Finish signing in",
1069 "description": "Asks whether the person has approved. Poll no faster than the interval. The token is returned once.",
1070 "security": [],
1071 "requestBody": {
1072 "required": true,
1073 "content": { "application/json": { "schema": {
1074 "type": "object",
1075 "required": ["device_code"],
1076 "properties": { "device_code": { "type": "string" } },
1077 } } },
1078 },
1079 "responses": { "200": {
1080 "description": "The state of the sign-in.",
1081 "content": { "application/json": { "schema": {
1082 "type": "object",
1083 "required": ["status"],
1084 "properties": {
1085 "status": { "type": "string", "enum": ["pending", "approved", "denied", "expired"] },
1086 "token": { "type": "string", "description": "Present when approved." },
Cards you act on in chat; agents comment and review as themselves; names shown cleanly; commits on the calendar1087 "username": { "type": "string", "description": "Lowercased: what the account is found and linked by." },
1088 "display_username": { "type": "string", "description": "The username as its owner wrote it; the same as username when they chose no case." },
Project settings say who created the project, by name1089 "verified": {
1090 "type": "boolean",
1091 "description": "Whether the account's email is confirmed.",
1092 },
1093 },
1094 } } },
1095 } },
1096 },
1097 },
1098 });
1099 match paths {
1100 Value::Object(paths) => paths,
1101 _ => Map::new(),
1102 }
1103}
1104
1105
1106/// Puts each operation's examples, where it has them, into its request
1107/// and response. Path and query values go under `x-example-params` and
1108/// `x-example-query`, which tools that build a request can use.
1109fn attach_examples(paths: &mut Map<String, Value>) {
1110 let examples = examples();
1111 for methods in paths.values_mut() {
1112 let Some(methods) = methods.as_object_mut() else { continue };
1113 for operation in methods.values_mut() {
1114 let id = operation["operationId"].as_str().unwrap_or_default().to_owned();
1115 let name = operation["x-operation"].as_str().unwrap_or_default().to_owned();
1116 let Some(example) = examples.get(&id).or_else(|| examples.get(&name)) else {
1117 continue;
1118 };
1119 if let Some(notes) = example.get("notes").and_then(Value::as_str) {
1120 let description = operation["description"].as_str().unwrap_or_default();
1121 operation["description"] = json!(format!("{description}\n\n{notes}"));
1122 }
1123 if let Some(response) = example.get("response") {
1124 let content = &mut operation["responses"]["200"]["content"]["application/json"];
1125 if content.is_object() {
1126 content["example"] = response.clone();
1127 }
1128 }
1129 if let Some(request) = example.get("request") {
1130 let content = &mut operation["requestBody"]["content"]["application/json"];
1131 if content.is_object() {
1132 content["example"] = request.clone();
1133 }
1134 }
1135 for (key, extension) in [("params", "x-example-params"), ("query", "x-example-query")] {
1136 if let Some(values) = example.get(key) {
1137 operation[extension] = values.clone();
1138 }
1139 }
1140 }
1141 }
1142}
1143
1144pub fn document() -> Value {
1145 let mut paths = onboarding();
1146 for route in ROUTES {
1147 let entry = paths
1148 .entry(openapi_path(route))
1149 .or_insert_with(|| json!({}));
1150 entry[route.method.to_lowercase()] = operation(route);
1151 }
1152 attach_examples(&mut paths);
1153 let tags: Vec<Value> = SECTIONS
1154 .iter()
1155 .map(|(name, description, ops)| {
1156 json!({
1157 "name": name,
1158 "description": description,
1159 // The section's operations in reading order, by MCP tool name.
1160 "x-tools": ops.iter().map(|op| op.name()).collect::<Vec<_>>(),
1161 })
1162 })
1163 .collect();
1164 let codes = ["unauthenticated", "payment_required", "forbidden", "not_found", "conflict", "invalid"];
1165 json!({
1166 "openapi": "3.1.0",
1167 "info": {
1168 "title": "g1t API",
1169 "version": "1",
1170 "description": "The REST API for g1t, a git forge built for agents. The same operations are available to agents as MCP tools at https://mcp.g1t.sh. Every name in a request or response body is `snake_case`; names you chose, such as a workflow's inputs or a secret's name, are returned as you wrote them.",
1171 "license": { "name": "MIT", "identifier": "MIT" },
1172 },
1173 "servers": [{ "url": "https://api.g1t.sh" }],
1174 "security": [{ "token": [] }, {}],
1175 "tags": tags,
1176 "paths": paths,
1177 "components": {
1178 "securitySchemes": {
1179 "token": {
1180 "type": "http",
1181 "scheme": "bearer",
1182 "description": "An access token, `g1t_…`. Public data needs none. Each operation names the scope a token needs for it; see https://docs.g1t.sh/guides/authentication/#scopes.",
1183 },
1184 },
1185 "schemas": {
1186 "Error": {
1187 "type": "object",
1188 "required": ["error"],
1189 "properties": {
1190 "error": {
1191 "type": "object",
1192 "required": ["code", "message"],
1193 "properties": {
1194 "code": { "type": "string", "enum": codes },
1195 "message": { "type": "string" },
1196 "needed_scope": {
1197 "type": "string",
1198 "description": "On a 403 for an access token without the scope the call needs: that scope, such as `issues:write`.",
1199 },
1200 },
1201 },
1202 },
1203 },
1204 },
1205 },
1206 })
1207}
1208
1209#[cfg(test)]
1210mod tests {
1211 use super::*;
1212
1213 #[test]
1214 fn every_route_is_documented_once() {
1215 let document = document();
1216 let mut ids = Vec::new();
1217 for (_, methods) in document["paths"].as_object().unwrap() {
1218 for (_, operation) in methods.as_object().unwrap() {
1219 ids.push(operation["operationId"].as_str().unwrap().to_owned());
1220 }
1221 }
1222 for op in Op::ALL {
1223 assert_eq!(
1224 ids.iter().filter(|id| *id == op.name()).count(),
1225 1,
1226 "{}",
1227 op.name()
1228 );
1229 }
1230 let mut unique = ids.clone();
1231 unique.sort();
1232 unique.dedup();
1233 assert_eq!(unique.len(), ids.len(), "operation ids repeat");
1234 }
1235
1236 #[test]
1237 fn path_and_query_inputs_are_not_repeated_in_the_body() {
1238 let document = document();
1239 let merge = &document["paths"]["/repos/{owner}/{name}/pulls/{number}/merge"]["post"];
1240 let body = &merge["requestBody"]["content"]["application/json"]["schema"]["properties"];
1241 assert!(body.get("keep_issue_open").is_some());
1242 assert!(body.get("repo").is_none() && body.get("number").is_none());
1243 let list = &document["paths"]["/repos"]["get"];
1244 assert_eq!(list["parameters"][0]["name"], "q");
1245 assert!(list.get("requestBody").is_none());
1246 }
1247
1248 #[test]
1249 fn every_operation_is_in_one_section() {
1250 for op in Op::ALL {
1251 let sections = SECTIONS
1252 .iter()
1253 .filter(|(_, _, ops)| ops.contains(&op))
1254 .count();
1255 assert_eq!(sections, 1, "{}", op.name());
1256 }
1257 }
1258
1259 #[test]
1260 fn titles_read_as_sentences() {
1261 assert_eq!(title(Op::CreateIssue), "Create an issue");
1262 assert_eq!(title(Op::Whoami), "Get the current user");
1263 }
1264
1265 #[test]
1266 fn every_operation_has_an_example_response() {
1267 let examples = examples();
1268 assert!(!examples.is_empty(), "reference.json does not parse");
1269 let document = document();
1270 let mut known = Vec::new();
1271 for (path, methods) in document["paths"].as_object().unwrap() {
1272 for (method, operation) in methods.as_object().unwrap() {
1273 known.push(operation["operationId"].as_str().unwrap().to_owned());
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts1274 // Nothing to show for a success without a body.
1275 if operation["responses"]["204"].is_object() {
1276 continue;
1277 }
Project settings say who created the project, by name1278 let example = &operation["responses"]["200"]["content"]["application/json"]["example"];
1279 assert!(!example.is_null(), "{method} {path} has no example response");
1280 }
1281 }
1282 for id in examples.keys() {
1283 assert!(known.contains(id), "reference.json names {id}, which is not an operation");
1284 }
1285 }
1286
1287 #[test]
1288 fn example_requests_send_only_what_the_body_takes() {
1289 let document = document();
1290 for (path, methods) in document["paths"].as_object().unwrap() {
1291 for (method, operation) in methods.as_object().unwrap() {
1292 let content = &operation["requestBody"]["content"]["application/json"];
1293 let Some(example) = content["example"].as_object() else { continue };
1294 let properties = &content["schema"]["properties"];
1295 for key in example.keys() {
1296 assert!(!properties[key].is_null(), "{method} {path}: {key} is not in the body");
1297 }
1298 }
1299 }
1300 }
1301
1302 /// The docs site's copy of the document. Run with `G1T_WRITE_OPENAPI=1`
1303 /// to rewrite it after changing an operation.
1304 #[test]
1305 fn the_docs_copy_is_current() {
1306 let path = concat!(env!("CARGO_MANIFEST_DIR"), "/../docs/src/data/openapi.json");
1307 let current = serde_json::to_string_pretty(&document()).unwrap() + "\n";
1308 if std::env::var_os("G1T_WRITE_OPENAPI").is_some() {
1309 std::fs::write(path, &current).unwrap();
1310 return;
1311 }
1312 let copy = std::fs::read_to_string(path).unwrap_or_default().replace("\r\n", "\n");
1313 assert!(
1314 copy == current,
1315 "apps/docs/src/data/openapi.json is out of date: run G1T_WRITE_OPENAPI=1 cargo test -p g1t-api openapi"
1316 );
1317 }
1318
1319 /// The reference shows responses as they are sent: `snake_case`.
1320 #[test]
1321 fn example_responses_are_snake_case() {
1322 let document = document();
1323 for (path, methods) in document["paths"].as_object().unwrap() {
1324 for (method, operation) in methods.as_object().unwrap() {
1325 let example = &operation["responses"]["200"]["content"]["application/json"]["example"];
1326 let leaked = g1t_kit::wire::camel_case_keys(example);
1327 assert!(leaked.is_empty(), "{method} {path} shows {leaked:?}");
1328 }
1329 }
1330 }
1331
1332 /// Examples never hold anything that reads as a real credential, which
1333 /// secret scanners rightly flag in a public repository: they end in `…`
1334 /// after the prefix, as `whsec_…` and `g1t_…` do.
1335 #[test]
1336 fn examples_hold_no_real_looking_secrets() {
1337 let prefixes = ["whsec_", "g1t_", "g1tr_", "g1trt_", "sk_live_", "sk_test_", "ghp_", "github_pat_", "xoxb-", "AKIA"];
1338 for (line, text) in REFERENCE.lines().enumerate() {
1339 for prefix in prefixes {
1340 let mut rest = text;
1341 while let Some(at) = rest.find(prefix) {
1342 let after = &rest[at + prefix.len()..];
1343 let run = after.chars().take_while(|c| c.is_ascii_alphanumeric()).count();
1344 assert!(
1345 run < 12,
1346 "reference.json line {}: `{prefix}` followed by {run} characters reads as a real secret; write `{prefix}…`",
1347 line + 1
1348 );
1349 rest = after;
1350 }
1351 }
1352 }
1353 }
1354}

This file's history is long; its oldest lines are credited to the oldest commit read.