Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp
724 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Inbox: the events service tells people what needs them as events arrive1/**
2 * Scopes: what an access token may do on its owner's behalf. Mirrors
3 * `crates/contracts/src/scopes.rs`, which is the source of truth; a Rust
4 * test keeps the tables here the same.
5 *
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers6 * A token's permissions are its scopes read per resource: each resource
7 * at none or one level, such as issues: write. What a request may do is
8 * the intersection of the owner's role, the token's reach (the workspace
9 * it is made for, and its repositories) and its permissions.
Inbox: the events service tells people what needs them as events arrive10 */
11
12export type ScopeResource =
13 | "repo"
14 | "code"
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar15 | "security"
Inbox: the events service tells people what needs them as events arrive16 | "packages"
17 | "issues"
18 | "pull_requests"
19 | "agents"
20 | "workflows"
Token reach: workflow_files scope, fine-grained reach, workspace token cap21 | "workflow_files"
Merge checks: statuses and check runs on every commit22 | "checks"
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9723 | "deployments"
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.24 | "observability"
Inbox: the events service tells people what needs them as events arrive25 | "memory"
26 | "account"
API: notifications over REST and MCP, with notifications scopes27 | "notifications"
The phone app: Chat in full with phone notifications, plus Code and Customize (#4)28 | "chat"
Inbox: the events service tells people what needs them as events arrive29 | "workspace"
Usage, Billing settings and prepaid AI credit; fixes from the UX audit30 | "billing"
Inbox: the events service tells people what needs them as events arrive31 | "access"
32 | "webhooks"
33 | "secrets"
Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens34 | "runners"
Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet35 | "models"
36 | "artifacts";
Inbox: the events service tells people what needs them as events arrive37
38export type ScopeLevel = "read" | "write" | "run" | "delete" | "admin";
39
40/** Every scope, grouped by resource, least first. */
41export const SCOPES = [
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9742 { scope: "repo:read", description: "See repositories, their settings, labels, timelines, releases, languages, contributors and security alerts, and search" },
The Branches page does things to branches now. It has tabs (Overview, Yours, Active, Stale, All, kept in the address as ?tab=) and search; Overview shows the default branch, then the first five of your branches, the active ones and the stale ones, each linking to the rest. Each branch is a row with its name in a code chip with a copy button, who made its latest commit and when, that commit's checks, behind and ahead counts with bars drawn against the largest shown, and its pull request (the open one, else the newest merged or closed) with its state; on a phone the columns fold under the name. Yours is branches whose latest commit is the viewer's; stale is no commit in 90 days.43 { scope: "repo:write", description: "Create repositories, create, rename and delete branches, change how pull requests merge and publish releases" },
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge44 { scope: "repo:admin", description: "Rename, archive, transfer, delete or change who can see a repository, change its rulesets, and dismiss security alerts" },
Inbox: the events service tells people what needs them as events arrive45 { scope: "code:read", description: "Clone and fetch private repositories with git" },
46 { scope: "code:write", description: "Push commits with git" },
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar47 { scope: "security:read", description: "See secret scanning, code scanning and vulnerability alerts, custom patterns, the dependency graph and SBOM, and security settings" },
48 { scope: "security:write", description: "Dismiss and reopen alerts, bypass push protection, review bypass requests, manage custom patterns, upload SARIF and change security settings" },
Inbox: the events service tells people what needs them as events arrive49 { scope: "packages:read", description: "Pull container images and install private packages" },
50 { scope: "packages:write", description: "Push container images and publish packages" },
Merge packages: roles, Actions access, source label, soft delete, API51 { scope: "packages:delete", description: "Delete and restore packages and their versions" },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.52 { scope: "issues:read", description: "Read issues and comments" },
Inbox: the events service tells people what needs them as events arrive53 { scope: "issues:write", description: "Open, edit, close and comment on issues" },
54 { scope: "pull_requests:read", description: "Read pull requests, their changes, sessions and merge queues" },
55 { scope: "pull_requests:write", description: "Open, review, close and merge pull requests" },
56 { scope: "workflows:read", description: "Read workflows, runs and logs" },
57 { scope: "workflows:write", description: "Run, cancel, rerun and turn workflows on or off" },
Token reach: workflow_files scope, fine-grained reach, workspace token cap58 { scope: "workflow_files:write", description: "Add, change and delete workflow files under .g1t/workflows and .github/workflows, with git or the API" },
Merge checks: statuses and check runs on every commit59 { scope: "checks:read", description: "Read commits' statuses, check runs, check suites and annotations" },
60 { scope: "checks:write", description: "Report statuses and check runs on commits, and ask for checks to run again" },
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9761 { scope: "deployments:read", description: "See deployments, their statuses and environments" },
62 { scope: "deployments:write", description: "Report deployments and their statuses, from any CI" },
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.63 { scope: "observability:read", description: "See projects' requests, logs, traces, errors and metrics, and their observability settings, ingest tokens and exports" },
64 { scope: "observability:write", description: "Resolve and ignore errors, and change projects' observability settings, ingest tokens and exports" },
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb9765 { scope: "account:read", description: "Read your email addresses, invites, invitations, pinned projects and stars" },
66 { scope: "account:write", description: "Change your email addresses, make invites, answer invitations, pin projects and star repositories" },
API: notifications over REST and MCP, with notifications scopes67 { scope: "notifications:read", description: "See your inbox, its threads, and what you subscribe to and watch" },
68 { scope: "notifications:write", description: "Mark notifications read, done, saved or snoozed, subscribe to threads and watch repositories" },
The phone app: Chat in full with phone notifications, plus Code and Customize (#4)69 { scope: "chat:read", description: "Read the conversations you are in: channels, direct messages, threads and reactions, live" },
70 { scope: "chat:write", description: "Send, edit and delete your messages, react, mark conversations read, and answer cards in chat" },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.71 { scope: "workspace:read", description: "Read workspace settings, invites, integrations, teams and rulesets" },
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge72 { scope: "workspace:admin", description: "Create and delete workspaces, invite members, connect integrations, create, change and delete teams, and change the workspace's rulesets" },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.73 { scope: "billing:read", description: "See a workspace's usage, budget and invoices" },
74 { scope: "billing:write", description: "Change a workspace's budget" },
Inbox: the events service tells people what needs them as events arrive75 { scope: "access:read", description: "See who has access to repositories" },
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar76 { scope: "access:admin", description: "Give and take away access to repositories, a team's included" },
Inbox: the events service tells people what needs them as events arrive77 { scope: "webhooks:read", description: "See webhooks and their deliveries" },
78 { scope: "webhooks:admin", description: "Create, change and delete webhooks" },
79 { scope: "secrets:read", description: "List secrets (never their values) and read variables" },
80 { scope: "secrets:admin", description: "Set and delete secrets and variables" },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.81 { scope: "runners:read", description: "See self-hosted runners and their groups" },
Inbox: the events service tells people what needs them as events arrive82 { scope: "runners:admin", description: "Register and remove self-hosted runners, change their groups and settings" },
Merge main into Artifacts Phase 283 { scope: "artifacts:read", description: "List, read and search artifacts you can see, their versions, and the numbers their dashboards show" },
84 { scope: "artifacts:write", description: "Create, rename, move, edit, trash and restore artifacts, and propose changes to them" },
85 { scope: "artifacts:admin", description: "Share artifacts, change who can open them, and delete them for good" },
Inbox: the events service tells people what needs them as events arrive86] as const;
87
Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet88/**
89 * Scopes of resources being built that tokens are not offered yet (Rust:
90 * `Resource::offered`). They parse in Rust and are typed here, but no
91 * preset, full access, OAuth request or token form hands them out, and no
92 * operation needs them. When one ships, its rows move to the end of
Merge main into Artifacts Phase 293 * `SCOPES` and `SCOPE_RESOURCES`. Empty now: Artifacts shipped last.
Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet94 */
Merge main into Artifacts Phase 295export const UPCOMING_SCOPES: readonly { scope: Scope; description: string }[] = [
Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet96] as const;
97
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.98/**
99 * Scopes of what g1t no longer has (Rust: `Resource::retired`): `agents`
Memory is gone: people's own harnesses keep their own memory (CLAUDE.md, AGENTS.md, auto-memory), so g1t's project and workspace notes that agents recalled and remembered only duplicated them. The recall and remember operations, their /repos/{owner}/{name}/memory routes, the memory MCP tool and its lines in the MCP instructions, the Memory section of the API reference and OpenAPI document (and the CLI's table generated from it) are removed, as are the work service's memory methods, the Memory pages of a project and of a workspace with their sidebar links, Home's Decisions card (which read decisions out of workspace memory), the Memory guide (its address and the old agent-memory, agents-and-memory and context-hub ones now lead to Connect a coding agent) and every mention in the docs, README, llms.txt, the landing page, the privacy policy and the Ask bench. Decision records, g1t why and g1t work stay as they were. memory:read and memory:write are retired as agents:run and the models scopes were: tokens and OAuth grants that hold them still parse and keep working for their other scopes, but no preset (the Agent preset and the OAuth default included), token form, mobile sign-in or hosted session hands them out and nothing needs them; looking up a ticket (search ticket, get_context), which needed memory:read, needs issues:read. The memories table stays in work's D1 untouched and is no longer read or written, except that purging a repository or deleting a workspace still deletes its old rows. Checked: cargo test for g1t-contracts (308), g1t-api (201), g1t (102 and 41), g1t-work (103) and g1t-integrations (65), cargo check of the workspace, the OpenAPI document and ops table regenerated, every workspace's typecheck, the site's 901 tests and a production build, the contracts' 48 tests, the phone app's 11, the deploy tool's 92, and the docs' tests and build.100 * (g1t's own agents), `memory` (project and workspace memory) and `models`
101 * (its model proxy and AI Gateway). Tokens
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.102 * and OAuth grants that stored them still read, but they are never offered
103 * or granted and no operation needs them: they give nothing. `isScope` and
104 * `parseScopes` leave them out.
105 */
106export const RETIRED_SCOPES = [
107 { scope: "agents:run", description: "Retired: put g1t's own agents to work. Grants nothing now" },
Memory is gone: people's own harnesses keep their own memory (CLAUDE.md, AGENTS.md, auto-memory), so g1t's project and workspace notes that agents recalled and remembered only duplicated them. The recall and remember operations, their /repos/{owner}/{name}/memory routes, the memory MCP tool and its lines in the MCP instructions, the Memory section of the API reference and OpenAPI document (and the CLI's table generated from it) are removed, as are the work service's memory methods, the Memory pages of a project and of a workspace with their sidebar links, Home's Decisions card (which read decisions out of workspace memory), the Memory guide (its address and the old agent-memory, agents-and-memory and context-hub ones now lead to Connect a coding agent) and every mention in the docs, README, llms.txt, the landing page, the privacy policy and the Ask bench. Decision records, g1t why and g1t work stay as they were. memory:read and memory:write are retired as agents:run and the models scopes were: tokens and OAuth grants that hold them still parse and keep working for their other scopes, but no preset (the Agent preset and the OAuth default included), token form, mobile sign-in or hosted session hands them out and nothing needs them; looking up a ticket (search ticket, get_context), which needed memory:read, needs issues:read. The memories table stays in work's D1 untouched and is no longer read or written, except that purging a repository or deleting a workspace still deletes its old rows. Checked: cargo test for g1t-contracts (308), g1t-api (201), g1t (102 and 41), g1t-work (103) and g1t-integrations (65), cargo check of the workspace, the OpenAPI document and ops table regenerated, every workspace's typecheck, the site's 901 tests and a production build, the contracts' 48 tests, the phone app's 11, the deploy tool's 92, and the docs' tests and build.108 { scope: "memory:read", description: "Retired: recall project and workspace memory. Grants nothing now" },
109 { scope: "memory:write", description: "Retired: save project and workspace memory. Grants nothing now" },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.110 { scope: "models:read", description: "Retired: see the AI Gateway's requests. Grants nothing now" },
111 { scope: "models:write", description: "Retired: send requests through the AI Gateway. Grants nothing now" },
112] as const;
113
Merge main into Artifacts Phase 2114export type Scope = (typeof SCOPES)[number]["scope"];
Inbox: the events service tells people what needs them as events arrive115
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers116/** Where a resource sits on the token form; only a person's token may hold account ones. */
117export type ResourceGroup = "repository" | "workspace" | "account";
118
119/** Resources in the order settings show them, with their names for people and their group. */
120export const SCOPE_RESOURCES: { resource: ScopeResource; label: string; group: ResourceGroup }[] = [
121 { resource: "repo", label: "Repositories", group: "repository" },
122 { resource: "code", label: "Code", group: "repository" },
123 { resource: "security", label: "Security", group: "repository" },
124 { resource: "packages", label: "Packages", group: "repository" },
125 { resource: "issues", label: "Issues", group: "repository" },
126 { resource: "pull_requests", label: "Pull requests", group: "repository" },
127 { resource: "workflows", label: "Workflows", group: "repository" },
128 { resource: "workflow_files", label: "Workflow files", group: "repository" },
129 { resource: "checks", label: "Checks and statuses", group: "repository" },
130 { resource: "deployments", label: "Deployments", group: "repository" },
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.131 { resource: "observability", label: "Observability", group: "repository" },
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers132 { resource: "account", label: "Your account", group: "account" },
133 { resource: "notifications", label: "Notifications", group: "account" },
The phone app: Chat in full with phone notifications, plus Code and Customize (#4)134 { resource: "chat", label: "Chat", group: "account" },
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers135 { resource: "workspace", label: "Workspaces", group: "workspace" },
136 { resource: "billing", label: "Billing", group: "workspace" },
137 { resource: "access", label: "Who has access", group: "repository" },
138 { resource: "webhooks", label: "Webhooks", group: "repository" },
139 { resource: "secrets", label: "Secrets and variables", group: "repository" },
140 { resource: "runners", label: "Self-hosted runners", group: "workspace" },
Merge main into Artifacts Phase 2141 { resource: "artifacts", label: "Artifacts", group: "workspace" },
Inbox: the events service tells people what needs them as events arrive142];
143
Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet144/** Resources not offered yet, as `UPCOMING_SCOPES`: settings never show them. */
145export const UPCOMING_RESOURCES: { resource: ScopeResource; label: string; group: ResourceGroup }[] = [
146];
147
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.148/** Resources of what g1t no longer has, as `RETIRED_SCOPES`: settings never show them. */
149export const RETIRED_RESOURCES: { resource: ScopeResource; label: string; group: ResourceGroup }[] = [
150 { resource: "agents", label: "g1t agents", group: "repository" },
Memory is gone: people's own harnesses keep their own memory (CLAUDE.md, AGENTS.md, auto-memory), so g1t's project and workspace notes that agents recalled and remembered only duplicated them. The recall and remember operations, their /repos/{owner}/{name}/memory routes, the memory MCP tool and its lines in the MCP instructions, the Memory section of the API reference and OpenAPI document (and the CLI's table generated from it) are removed, as are the work service's memory methods, the Memory pages of a project and of a workspace with their sidebar links, Home's Decisions card (which read decisions out of workspace memory), the Memory guide (its address and the old agent-memory, agents-and-memory and context-hub ones now lead to Connect a coding agent) and every mention in the docs, README, llms.txt, the landing page, the privacy policy and the Ask bench. Decision records, g1t why and g1t work stay as they were. memory:read and memory:write are retired as agents:run and the models scopes were: tokens and OAuth grants that hold them still parse and keep working for their other scopes, but no preset (the Agent preset and the OAuth default included), token form, mobile sign-in or hosted session hands them out and nothing needs them; looking up a ticket (search ticket, get_context), which needed memory:read, needs issues:read. The memories table stays in work's D1 untouched and is no longer read or written, except that purging a repository or deleting a workspace still deletes its old rows. Checked: cargo test for g1t-contracts (308), g1t-api (201), g1t (102 and 41), g1t-work (103) and g1t-integrations (65), cargo check of the workspace, the OpenAPI document and ops table regenerated, every workspace's typecheck, the site's 901 tests and a production build, the contracts' 48 tests, the phone app's 11, the deploy tool's 92, and the docs' tests and build.151 { resource: "memory", label: "Memory", group: "repository" },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.152 { resource: "models", label: "AI Gateway", group: "workspace" },
153];
154
Inbox: the events service tells people what needs them as events arrive155const LEVEL_ORDER: Record<ScopeLevel, number> = { read: 0, write: 1, run: 2, delete: 3, admin: 4 };
156
157export function scopeResource(scope: Scope): ScopeResource {
158 return scope.split(":")[0] as ScopeResource;
159}
160
161export function scopeLevel(scope: Scope): ScopeLevel {
162 return scope.split(":")[1] as ScopeLevel;
163}
164
165export function isScope(text: string): text is Scope {
166 return SCOPES.some((row) => row.scope === text);
167}
168
169/** Changes that are hard to undo, or decide who can reach what. */
170export function isDangerous(scope: Scope): boolean {
171 const level = scopeLevel(scope);
172 return level === "admin" || level === "delete";
173}
174
175export function describeScope(scope: Scope): string {
Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet176 return [...SCOPES, ...UPCOMING_SCOPES].find((row) => row.scope === scope)?.description ?? scope;
Inbox: the events service tells people what needs them as events arrive177}
178
179/** Whether holding `held` gives `needed`: the same resource, at its level or lower. */
180export function scopeIncludes(held: Scope, needed: Scope): boolean {
181 return (
182 scopeResource(held) === scopeResource(needed) &&
183 LEVEL_ORDER[scopeLevel(held)] >= LEVEL_ORDER[scopeLevel(needed)]
184 );
185}
186
The phone app: Chat in full with phone notifications, plus Code and Customize (#4)187/**
188 * Whether a token holding `scopes` may do what `needed` gates (Rust:
189 * `TokenAccess::allows`). Null or absent scopes are full access, which
190 * holds every scope; unknown names give nothing.
191 */
192export function tokenAllows(scopes: readonly string[] | null | undefined, needed: Scope): boolean {
193 if (scopes === null || scopes === undefined) return true;
194 return scopes.some((held) => isScope(held) && scopeIncludes(held, needed));
195}
196
Inbox: the events service tells people what needs them as events arrive197/** The levels a resource has, least first. */
198export function levelsOf(resource: ScopeResource): ScopeLevel[] {
199 return SCOPES.filter((row) => scopeResource(row.scope) === resource).map((row) => scopeLevel(row.scope));
200}
201
One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers202/** The token form's groups, in order. */
203export const RESOURCE_GROUPS: { group: ResourceGroup; label: string; about: string }[] = [
204 { group: "repository", label: "Repository permissions", about: "What it may do in the repositories it reaches." },
205 { group: "workspace", label: "Workspace permissions", about: "What it may do with the workspaces it reaches themselves." },
206 { group: "account", label: "Account permissions", about: "What it may do with your own account. Personal tokens only." },
207];
208
209/** A token's permissions: each resource held, at its highest level; left out is none. */
210export type Permissions = Partial<Record<ScopeResource, ScopeLevel>>;
211
212/** Scopes as permissions. Null scopes (full access) are every resource at its highest. */
213export function permissionsOf(scopes: readonly string[] | null): Permissions {
214 const permissions: Permissions = {};
215 const held = scopes === null ? SCOPES.map((row) => row.scope) : parseScopes(scopes.join(" "));
216 for (const scope of held) {
217 const resource = scopeResource(scope);
218 const now = permissions[resource];
219 if (!now || LEVEL_ORDER[scopeLevel(scope)] > LEVEL_ORDER[now]) permissions[resource] = scopeLevel(scope);
220 }
221 return permissions;
222}
223
224/** Permissions as the scopes a token stores: the highest of each resource, in table order. */
225export function scopesOfPermissions(permissions: Permissions): Scope[] {
226 const wanted = new Set(
227 Object.entries(permissions)
228 .filter(([, level]) => level)
229 .map(([resource, level]) => `${resource}:${level}`),
230 );
231 return SCOPES.map((row) => row.scope).filter((scope) => wanted.has(scope));
232}
233
234/** The longest a token with an expiry may last, in days. */
235export const MAX_TOKEN_LIFETIME_DAYS = 366;
236
237/** The most repositories a token may select. */
238export const MAX_SELECTED_REPOSITORIES = 50;
239
Inbox: the events service tells people what needs them as events arrive240/** Scopes from text separated by spaces or commas, in table order; unknown ones are left out. */
241export function parseScopes(text: string): Scope[] {
242 const given = new Set(text.split(/[\s,]+/).map((part) => part.trim().toLowerCase()));
243 return SCOPES.map((row) => row.scope).filter((scope) => given.has(scope));
244}
245
246/** What a token stores for full access. */
247export const FULL_ACCESS = "*";
248
249export type PresetId = "read_only" | "agent" | "ci" | "full";
250
The phone app: Chat in full with phone notifications, plus Code and Customize (#4)251/** Starting points for choosing scopes. `*` is full access. No preset gives chat: an application gets it only by asking for it. */
Inbox: the events service tells people what needs them as events arrive252export const PRESET_SCOPES = {
253 read_only: [
Memory is gone: people's own harnesses keep their own memory (CLAUDE.md, AGENTS.md, auto-memory), so g1t's project and workspace notes that agents recalled and remembered only duplicated them. The recall and remember operations, their /repos/{owner}/{name}/memory routes, the memory MCP tool and its lines in the MCP instructions, the Memory section of the API reference and OpenAPI document (and the CLI's table generated from it) are removed, as are the work service's memory methods, the Memory pages of a project and of a workspace with their sidebar links, Home's Decisions card (which read decisions out of workspace memory), the Memory guide (its address and the old agent-memory, agents-and-memory and context-hub ones now lead to Connect a coding agent) and every mention in the docs, README, llms.txt, the landing page, the privacy policy and the Ask bench. Decision records, g1t why and g1t work stay as they were. memory:read and memory:write are retired as agents:run and the models scopes were: tokens and OAuth grants that hold them still parse and keep working for their other scopes, but no preset (the Agent preset and the OAuth default included), token form, mobile sign-in or hosted session hands them out and nothing needs them; looking up a ticket (search ticket, get_context), which needed memory:read, needs issues:read. The memories table stays in work's D1 untouched and is no longer read or written, except that purging a repository or deleting a workspace still deletes its old rows. Checked: cargo test for g1t-contracts (308), g1t-api (201), g1t (102 and 41), g1t-work (103) and g1t-integrations (65), cargo check of the workspace, the OpenAPI document and ops table regenerated, every workspace's typecheck, the site's 901 tests and a production build, the contracts' 48 tests, the phone app's 11, the deploy tool's 92, and the docs' tests and build.254 "repo:read", "code:read", "security:read", "packages:read", "issues:read", "pull_requests:read", "workflows:read", "checks:read", "deployments:read", "observability:read", "account:read", "notifications:read", "workspace:read", "billing:read", "access:read", "webhooks:read", "secrets:read", "runners:read", "artifacts:read",
Inbox: the events service tells people what needs them as events arrive255 ] as const,
256 agent: [
Memory is gone: people's own harnesses keep their own memory (CLAUDE.md, AGENTS.md, auto-memory), so g1t's project and workspace notes that agents recalled and remembered only duplicated them. The recall and remember operations, their /repos/{owner}/{name}/memory routes, the memory MCP tool and its lines in the MCP instructions, the Memory section of the API reference and OpenAPI document (and the CLI's table generated from it) are removed, as are the work service's memory methods, the Memory pages of a project and of a workspace with their sidebar links, Home's Decisions card (which read decisions out of workspace memory), the Memory guide (its address and the old agent-memory, agents-and-memory and context-hub ones now lead to Connect a coding agent) and every mention in the docs, README, llms.txt, the landing page, the privacy policy and the Ask bench. Decision records, g1t why and g1t work stay as they were. memory:read and memory:write are retired as agents:run and the models scopes were: tokens and OAuth grants that hold them still parse and keep working for their other scopes, but no preset (the Agent preset and the OAuth default included), token form, mobile sign-in or hosted session hands them out and nothing needs them; looking up a ticket (search ticket, get_context), which needed memory:read, needs issues:read. The memories table stays in work's D1 untouched and is no longer read or written, except that purging a repository or deleting a workspace still deletes its old rows. Checked: cargo test for g1t-contracts (308), g1t-api (201), g1t (102 and 41), g1t-work (103) and g1t-integrations (65), cargo check of the workspace, the OpenAPI document and ops table regenerated, every workspace's typecheck, the site's 901 tests and a production build, the contracts' 48 tests, the phone app's 11, the deploy tool's 92, and the docs' tests and build.257 "repo:read", "code:read", "code:write", "security:read", "packages:read", "issues:read", "issues:write", "pull_requests:read", "pull_requests:write", "workflows:read", "checks:read", "deployments:read", "observability:read", "account:read", "notifications:read", "notifications:write", "workspace:read", "billing:read", "access:read", "webhooks:read", "secrets:read", "artifacts:read",
Inbox: the events service tells people what needs them as events arrive258 ] as const,
259 ci: [
Merge checks: statuses and check runs on every commit260 "repo:read", "code:read", "code:write", "packages:read", "packages:write", "workflows:read", "workflows:write", "checks:read", "checks:write", "deployments:read", "deployments:write",
Inbox: the events service tells people what needs them as events arrive261 ] as const,
262 full: [
263 "*",
264 ] as const,
265};
266
267export const PRESETS: { id: PresetId; label: string; description: string }[] = [
268 { id: "read_only", label: "Read only", description: "Read everything you can read; change nothing." },
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.269 { id: "agent", label: "Agent", description: "Read everything, work on issues and pull requests, and push code." },
Merge checks: statuses and check runs on every commit270 { id: "ci", label: "CI", description: "Clone and push code, push and pull packages, run workflows, and report checks and deployments." },
Inbox: the events service tells people what needs them as events arrive271 { id: "full", label: "Full access", description: "Everything you can do, including deleting repositories and changing who has access." },
272];
273
274/** The scopes of a preset, or null for full access. */
275export function presetScopes(id: PresetId): Scope[] | null {
276 if (id === "full") return null;
277 return [...PRESET_SCOPES[id]] as Scope[];
278}
279
280/** What an OAuth client gets when it asks for nothing in particular. */
281export const OAUTH_DEFAULT_SCOPES: Scope[] = [...PRESET_SCOPES.agent];
282
283/** The operation each scope gates, by the API's operation names. */
284export const OPERATION_SCOPES = [
285 ["list_emails", "account:read"],
286 ["add_email", "account:write"],
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)287 ["confirm_email", "account:write"],
Inbox: the events service tells people what needs them as events arrive288 ["remove_email", "account:write"],
289 ["update_email_settings", "account:write"],
Merge branch 'worktree-agent-a6da31375506fc440'290 ["list_invites", "account:read"],
291 ["create_invite", "account:write"],
292 ["revoke_invite", "account:write"],
293 ["resend_invite", "account:write"],
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)294 ["list_invitations", "account:read"],
295 ["accept_invitation", "account:write"],
296 ["decline_invitation", "account:write"],
Inbox: the events service tells people what needs them as events arrive297 ["list_my_repo_invitations", "account:read"],
298 ["accept_repo_invitation", "account:write"],
299 ["decline_repo_invitation", "account:write"],
API: pinned projects over REST and MCP300 // Your pinned projects: a preference of your account.
301 ["list_pinned_projects", "account:read"],
302 ["pin_project", "account:write"],
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97303 // Your stars: a preference of your account.
304 ["list_starred", "account:read"],
305 ["check_starred", "account:read"],
306 ["star_repo", "account:write"],
307 ["unstar_repo", "account:write"],
API: pinned projects over REST and MCP308 ["unpin_project", "account:write"],
309 ["reorder_pinned_projects", "account:write"],
API: notifications over REST and MCP, with notifications scopes310 // Your inbox: notifications, subscriptions and watching.
311 ["list_notifications", "notifications:read"],
312 ["get_notification_thread", "notifications:read"],
313 ["get_thread_subscription", "notifications:read"],
314 ["get_repo_subscription", "notifications:read"],
315 ["list_watched_repos", "notifications:read"],
316 ["mark_notifications_read", "notifications:write"],
317 ["mark_thread_read", "notifications:write"],
318 ["mark_thread_done", "notifications:write"],
319 ["save_thread", "notifications:write"],
320 ["snooze_thread", "notifications:write"],
321 ["set_thread_subscription", "notifications:write"],
322 ["delete_thread_subscription", "notifications:write"],
323 ["set_repo_subscription", "notifications:write"],
324 ["delete_repo_subscription", "notifications:write"],
Inbox: the events service tells people what needs them as events arrive325 ["create_workspace", "workspace:admin"],
326 ["delete_workspace", "workspace:admin"],
Merge branch 'worktree-agent-ad7c6d88d93adc817'327 ["get_workspace", "workspace:read"],
Inbox: the events service tells people what needs them as events arrive328 ["update_workspace", "workspace:admin"],
Merge main (membership, two-factor, GitHub repo roles) into tokens329 ["list_members", "workspace:read"],
330 ["update_member", "workspace:admin"],
331 ["remove_member", "workspace:admin"],
332 ["transfer_ownership", "workspace:admin"],
333 ["leave_workspace", "account:write"],
Inbox: the events service tells people what needs them as events arrive334 ["list_workspace_invites", "workspace:read"],
335 ["invite_member", "workspace:admin"],
336 ["revoke_workspace_invite", "workspace:admin"],
337 ["list_integrations", "workspace:read"],
338 ["connect_integration", "workspace:admin"],
AI Gateway: OpenAI's format, open models, and your own providers339 ["update_integration", "workspace:admin"],
Inbox: the events service tells people what needs them as events arrive340 ["disconnect_integration", "workspace:admin"],
341 ["test_integration", "workspace:admin"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar342 ["list_teams", "workspace:read"],
343 ["get_team", "workspace:read"],
344 ["list_team_members", "workspace:read"],
345 ["list_child_teams", "workspace:read"],
346 ["list_team_repos", "workspace:read"],
347 ["list_user_teams", "workspace:read"],
348 ["create_team", "workspace:admin"],
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge349 ["list_workspace_rulesets", "workspace:read"],
350 ["get_workspace_ruleset", "workspace:read"],
351 ["list_workspace_rule_evaluations", "workspace:read"],
352 ["create_workspace_ruleset", "workspace:admin"],
353 ["update_workspace_ruleset", "workspace:admin"],
354 ["delete_workspace_ruleset", "workspace:admin"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar355 ["update_team", "workspace:admin"],
356 ["delete_team", "workspace:admin"],
357 ["set_team_member", "workspace:admin"],
358 ["remove_team_member", "workspace:admin"],
359 ["set_team_review_assignment", "workspace:admin"],
The contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.360 // A workspace's billing: usage, budget and invoices.
Usage, Billing settings and prepaid AI credit; fixes from the UX audit361 ["get_usage", "billing:read"],
362 ["get_budget", "billing:read"],
363 ["list_invoices", "billing:read"],
364 ["get_billing_details", "billing:read"],
365 ["set_budget", "billing:write"],
Inbox: the events service tells people what needs them as events arrive366 ["list_repos", "repo:read"],
367 ["get_repo", "repo:read"],
g1t coordinates the work and the person's own sessions do it: Ask g1t reads g1t with the same tools any agent gets, answers in one conversation shared with the @g1t direct message in Chat, and hands work to sessions in the person's own harness, whose subagents g1t records, ties to issues and pull requests, and lets see each other.368 // A file or directory of a repository, as clone and fetch would give it.
369 ["get_contents", "code:read"],
370 ["list_commits", "code:read"],
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.371 ["download_tarball_archive", "code:read"],
372 ["download_zipball_archive", "code:read"],
Merge branch 'worktree-agent-ab8033ab973f8d99a'373 ["why", "code:read"],
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97374 // Projects follow their repositories.
375 ["list_projects", "repo:read"],
376 ["get_project", "repo:read"],
Inbox: the events service tells people what needs them as events arrive377 ["search", "repo:read"],
378 ["list_events", "repo:read"],
g1t coordinates the work and the person's own sessions do it: Ask g1t reads g1t with the same tools any agent gets, answers in one conversation shared with the @g1t direct message in Chat, and hands work to sessions in the person's own harness, whose subagents g1t records, ties to issues and pull requests, and lets see each other.379 // A workspace's activity: the events of its repositories the caller can read.
380 ["get_workspace_activity", "repo:read"],
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97381 // What the default branch says about a repository, who starred it, and
382 // its releases.
383 ["get_languages", "repo:read"],
384 ["list_contributors", "repo:read"],
385 ["get_license", "repo:read"],
386 ["list_stargazers", "repo:read"],
387 ["list_releases", "repo:read"],
388 ["get_latest_release", "repo:read"],
389 ["get_release_by_tag", "repo:read"],
390 ["get_release", "repo:read"],
391 ["create_release", "repo:write"],
392 ["update_release", "repo:write"],
393 ["delete_release", "repo:write"],
Inbox: the events service tells people what needs them as events arrive394 ["list_labels", "repo:read"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar395 ["list_milestones", "repo:read"],
396 ["get_milestone", "repo:read"],
397 ["create_label", "issues:write"],
398 ["update_label", "issues:write"],
399 ["delete_label", "issues:write"],
400 ["add_default_labels", "issues:write"],
401 ["create_milestone", "issues:write"],
402 ["update_milestone", "issues:write"],
403 ["delete_milestone", "issues:write"],
Inbox: the events service tells people what needs them as events arrive404 ["get_repo_settings", "repo:read"],
405 ["list_check_names", "repo:read"],
406 ["list_deleted_repos", "repo:read"],
407 ["list_security_alerts", "repo:read"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar408 ["get_codeowners_errors", "repo:read"],
Inbox: the events service tells people what needs them as events arrive409 ["create_repo", "repo:write"],
410 ["update_repo", "repo:write"],
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97411 ["update_project", "repo:write"],
Inbox: the events service tells people what needs them as events arrive412 ["update_repo_settings", "repo:write"],
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge413 ["list_repo_rulesets", "repo:read"],
414 ["get_repo_ruleset", "repo:read"],
415 ["get_branch_rules", "repo:read"],
416 ["list_rule_evaluations", "repo:read"],
417 ["create_repo_ruleset", "repo:admin"],
418 ["update_repo_ruleset", "repo:admin"],
419 ["delete_repo_ruleset", "repo:admin"],
Inbox: the events service tells people what needs them as events arrive420 ["rename_branch", "repo:write"],
The Branches page does things to branches now. It has tabs (Overview, Yours, Active, Stale, All, kept in the address as ?tab=) and search; Overview shows the default branch, then the first five of your branches, the active ones and the stale ones, each linking to the rest. Each branch is a row with its name in a code chip with a copy button, who made its latest commit and when, that commit's checks, behind and ahead counts with bars drawn against the largest shown, and its pull request (the open one, else the newest merged or closed) with its state; on a phone the columns fold under the name. Yours is branches whose latest commit is the viewer's; stale is no commit in 90 days.421 ["create_branch", "repo:write"],
422 ["delete_branch", "repo:write"],
Inbox: the events service tells people what needs them as events arrive423 ["rename_repo", "repo:admin"],
424 ["transfer_repo", "repo:admin"],
425 ["archive_repo", "repo:admin"],
426 ["unarchive_repo", "repo:admin"],
427 ["set_repo_visibility", "repo:admin"],
428 ["delete_repo", "repo:admin"],
429 ["restore_repo", "repo:admin"],
430 ["purge_repo", "repo:admin"],
431 ["dismiss_security_alert", "repo:admin"],
432 ["reopen_security_alert", "repo:admin"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar433 // The security suite.
434 ["list_secret_scanning_alerts", "security:read"],
435 ["get_secret_scanning_alert", "security:read"],
436 ["list_secret_scanning_locations", "security:read"],
437 ["list_bypass_requests", "security:read"],
438 ["list_custom_patterns", "security:read"],
439 ["list_code_scanning_alerts", "security:read"],
440 ["get_code_scanning_alert", "security:read"],
441 ["list_code_scanning_analyses", "security:read"],
442 ["get_sarif_upload", "security:read"],
443 ["list_vulnerability_alerts", "security:read"],
444 ["get_vulnerability_alert", "security:read"],
445 ["get_dependency_graph", "security:read"],
446 ["get_sbom", "security:read"],
447 ["compare_dependencies", "security:read"],
448 ["get_security_settings", "security:read"],
449 ["get_workspace_security_settings", "security:read"],
450 ["get_security_overview", "security:read"],
Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9451 ["list_security_advisories", "security:read"],
452 ["get_security_advisory", "security:read"],
453 ["list_vulnerability_reports", "security:read"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar454 ["update_secret_scanning_alert", "security:write"],
455 ["bypass_push_protection", "security:write"],
456 ["check_secret_validity", "security:write"],
457 ["review_bypass_request", "security:write"],
458 ["create_custom_pattern", "security:write"],
459 ["update_custom_pattern", "security:write"],
460 ["delete_custom_pattern", "security:write"],
461 ["dry_run_custom_pattern", "security:write"],
462 ["update_code_scanning_alert", "security:write"],
463 ["upload_sarif", "security:write"],
464 ["update_vulnerability_alert", "security:write"],
465 ["update_security_settings", "security:write"],
466 ["update_workspace_security_settings", "security:write"],
Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9467 ["create_security_advisory", "security:write"],
468 ["update_security_advisory", "security:write"],
469 ["set_security_advisory_state", "security:write"],
470 ["report_vulnerability", "security:write"],
471 ["review_vulnerability_report", "security:write"],
Inbox: the events service tells people what needs them as events arrive472 ["list_issues", "issues:read"],
473 ["get_issue", "issues:read"],
474 ["create_issue", "issues:write"],
475 ["update_issue", "issues:write"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar476 ["list_issue_labels", "issues:read"],
477 ["add_issue_labels", "issues:write"],
478 ["set_issue_labels", "issues:write"],
479 ["remove_issue_labels", "issues:write"],
Inbox: the events service tells people what needs them as events arrive480 ["close_issue", "issues:write"],
481 ["reopen_issue", "issues:write"],
482 ["add_comment", "issues:write"],
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts483 ["edit_comment", "issues:write"],
484 ["delete_comment", "issues:write"],
Memory is gone: people's own harnesses keep their own memory (CLAUDE.md, AGENTS.md, auto-memory), so g1t's project and workspace notes that agents recalled and remembered only duplicated them. The recall and remember operations, their /repos/{owner}/{name}/memory routes, the memory MCP tool and its lines in the MCP instructions, the Memory section of the API reference and OpenAPI document (and the CLI's table generated from it) are removed, as are the work service's memory methods, the Memory pages of a project and of a workspace with their sidebar links, Home's Decisions card (which read decisions out of workspace memory), the Memory guide (its address and the old agent-memory, agents-and-memory and context-hub ones now lead to Connect a coding agent) and every mention in the docs, README, llms.txt, the landing page, the privacy policy and the Ask bench. Decision records, g1t why and g1t work stay as they were. memory:read and memory:write are retired as agents:run and the models scopes were: tokens and OAuth grants that hold them still parse and keep working for their other scopes, but no preset (the Agent preset and the OAuth default included), token form, mobile sign-in or hosted session hands them out and nothing needs them; looking up a ticket (search ticket, get_context), which needed memory:read, needs issues:read. The memories table stays in work's D1 untouched and is no longer read or written, except that purging a repository or deleting a workspace still deletes its old rows. Checked: cargo test for g1t-contracts (308), g1t-api (201), g1t (102 and 41), g1t-work (103) and g1t-integrations (65), cargo check of the workspace, the OpenAPI document and ops table regenerated, every workspace's typecheck, the site's 901 tests and a production build, the contracts' 48 tests, the phone app's 11, the deploy tool's 92, and the docs' tests and build.485 ["get_context", "issues:read"],
Inbox: the events service tells people what needs them as events arrive486 ["import_issue", "issues:write"],
Merge branch 'worktree-agent-a6ec0a89d7fe7a9ae'487 ["list_claims", "issues:read"],
488 ["get_work", "issues:read"],
489 ["claim_issue", "issues:write"],
490 ["release_claim", "issues:write"],
491 ["hand_off_issue", "issues:write"],
Inbox: the events service tells people what needs them as events arrive492 ["list_pull_requests", "pull_requests:read"],
493 ["get_pull_request", "pull_requests:read"],
494 ["get_pull_request_changes", "pull_requests:read"],
495 ["read_session", "pull_requests:read"],
496 ["get_merge_queue", "pull_requests:read"],
Merge branch 'worktree-agent-ab8033ab973f8d99a'497 ["list_decisions", "pull_requests:read"],
Inbox: the events service tells people what needs them as events arrive498 ["create_pull_request", "pull_requests:write"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar499 ["update_pull_request", "pull_requests:write"],
Inbox: the events service tells people what needs them as events arrive500 ["record_session", "pull_requests:write"],
Merge branch 'worktree-agent-ab8033ab973f8d99a'501 ["record_decision", "pull_requests:write"],
Inbox: the events service tells people what needs them as events arrive502 ["mark_pull_request_ready", "pull_requests:write"],
503 ["close_pull_request", "pull_requests:write"],
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts504 ["reopen_pull_request", "pull_requests:write"],
505 ["convert_pull_request_to_draft", "pull_requests:write"],
Inbox: the events service tells people what needs them as events arrive506 ["review_pull_request", "pull_requests:write"],
507 ["merge_pull_request", "pull_requests:write"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar508 ["request_reviewers", "pull_requests:write"],
509 ["remove_requested_reviewers", "pull_requests:write"],
Merge branch 'worktree-agent-a6ec0a89d7fe7a9ae'510 ["get_session", "pull_requests:read"],
511 ["list_sessions", "pull_requests:read"],
512 ["start_session", "pull_requests:write"],
513 ["update_session", "pull_requests:write"],
514 ["end_session", "pull_requests:write"],
515 ["record_session_entries", "pull_requests:write"],
g1t coordinates the work and the person's own sessions do it: Ask g1t reads g1t with the same tools any agent gets, answers in one conversation shared with the @g1t direct message in Chat, and hands work to sessions in the person's own harness, whose subagents g1t records, ties to issues and pull requests, and lets see each other.516 ["start_agent_session", "pull_requests:write"],
Inbox: the events service tells people what needs them as events arrive517 ["list_workflows", "workflows:read"],
Merge branch 'worktree-agent-a4db4b523bb973765'518 ["get_workflow", "workflows:read"],
Inbox: the events service tells people what needs them as events arrive519 ["list_workflow_runs", "workflows:read"],
520 ["get_workflow_run", "workflows:read"],
521 ["get_job_logs", "workflows:read"],
522 ["dispatch_workflow", "workflows:write"],
523 ["cancel_workflow_run", "workflows:write"],
524 ["rerun_workflow_run", "workflows:write"],
525 ["update_workflow", "workflows:write"],
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2526 ["list_artifacts", "workflows:read"],
527 ["list_workflow_run_artifacts", "workflows:read"],
528 ["get_artifact", "workflows:read"],
529 ["download_artifact", "workflows:read"],
530 ["get_artifact_retention", "workflows:read"],
531 ["delete_artifact", "workflows:write"],
532 ["set_artifact_retention", "workflows:write"],
Merge branch 'worktree-agent-a3b9b1f730f55b5bf'533 ["list_caches", "workflows:read"],
534 ["get_cache_usage", "workflows:read"],
535 ["delete_caches_by_key", "workflows:write"],
536 ["delete_cache", "workflows:write"],
Merge checks: statuses and check runs on every commit537 ["list_commit_statuses", "checks:read"],
538 ["get_combined_status", "checks:read"],
539 ["list_check_runs_for_ref", "checks:read"],
540 ["get_check_run", "checks:read"],
541 ["list_check_run_annotations", "checks:read"],
542 ["list_check_suites_for_ref", "checks:read"],
543 ["get_check_suite", "checks:read"],
544 ["create_commit_status", "checks:write"],
545 ["create_check_run", "checks:write"],
546 ["update_check_run", "checks:write"],
547 ["rerequest_check_run", "checks:write"],
548 ["rerequest_check_suite", "checks:write"],
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97549 // Deployments, wherever they run: reading them, and reporting them.
550 ["list_deployments", "deployments:read"],
551 ["get_deployment", "deployments:read"],
552 ["list_deployment_statuses", "deployments:read"],
553 ["list_environments", "deployments:read"],
554 ["get_environment", "deployments:read"],
555 ["create_deployment", "deployments:write"],
556 ["create_deployment_status", "deployments:write"],
Merge branch 'worktree-agent-a4d35ee70c50683d0' into claude/cool-newton-7nm8r9557 ["start_deployment_build", "deployments:write"],
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.558 // Observability: what a project's software did, and how it is collected.
559 ["get_observability_overview", "observability:read"],
560 ["list_requests", "observability:read"],
561 ["get_request", "observability:read"],
562 ["list_logs", "observability:read"],
563 ["list_traces", "observability:read"],
564 ["get_trace", "observability:read"],
565 ["list_errors", "observability:read"],
566 ["list_metrics", "observability:read"],
567 ["get_metric", "observability:read"],
568 ["get_observability_settings", "observability:read"],
569 ["list_ingest_tokens", "observability:read"],
570 ["list_telemetry_exports", "observability:read"],
571 ["get_observability_usage", "observability:read"],
572 ["update_error", "observability:write"],
573 ["update_observability_settings", "observability:write"],
574 ["create_ingest_token", "observability:write"],
575 ["delete_ingest_token", "observability:write"],
576 ["create_telemetry_export", "observability:write"],
577 ["update_telemetry_export", "observability:write"],
578 ["delete_telemetry_export", "observability:write"],
Merge branch 'worktree-agent-a3abfcce648e87dca'579 // What keeps runs safe: the runs environments hold and reviewing them,
580 // approving a pull request's run, and a repository's own rules for its
581 // environments and tokens, which are an admin's.
582 ["get_pending_deployments", "workflows:read"],
583 ["review_pending_deployments", "workflows:write"],
584 ["approve_workflow_run", "workflows:write"],
585 ["get_workflow_permissions", "repo:read"],
586 ["get_fork_pr_approval", "repo:read"],
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts587 ["get_actions_access", "repo:read"],
Merge branch 'worktree-agent-a3abfcce648e87dca'588 ["update_environment", "repo:admin"],
589 ["delete_environment", "repo:admin"],
590 ["set_workflow_permissions", "repo:admin"],
591 ["set_fork_pr_approval", "repo:admin"],
Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts592 ["set_actions_access", "repo:admin"],
Merge branch 'worktree-agent-a3abfcce648e87dca'593 // Starting workflows from outside, as a push would.
594 ["create_repository_dispatch", "code:write"],
595 // A workspace's policy for its repositories' tokens.
596 ["get_workspace_workflow_permissions", "workspace:read"],
597 ["set_workspace_workflow_permissions", "workspace:admin"],
Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's.598 ["list_workspace_managed_workflows", "workspace:read"],
599 ["create_workspace_managed_workflow", "workspace:admin"],
600 ["update_workspace_managed_workflow", "workspace:admin"],
601 ["delete_workspace_managed_workflow", "workspace:admin"],
API and MCP for a workspace's personal access token rules, members' tokens and approvals602 // A workspace's rules for personal access tokens, and its members' tokens.
603 ["get_token_policy", "workspace:read"],
604 ["set_token_policy", "workspace:admin"],
605 ["list_member_tokens", "access:read"],
606 ["list_token_requests", "access:read"],
607 ["review_token_request", "access:admin"],
608 ["revoke_member_token", "access:admin"],
Inbox: the events service tells people what needs them as events arrive609 ["list_collaborators", "access:read"],
610 ["get_collaborator_permission", "access:read"],
611 ["list_repo_invitations", "access:read"],
612 ["list_outside_collaborators", "access:read"],
613 ["add_collaborator", "access:admin"],
614 ["update_collaborator", "access:admin"],
615 ["remove_collaborator", "access:admin"],
616 ["revoke_repo_invitation", "access:admin"],
617 ["set_base_permission", "access:admin"],
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar618 ["set_team_repo", "access:admin"],
619 ["remove_team_repo", "access:admin"],
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca620 ["list_deploy_keys", "access:read"],
621 ["get_deploy_key", "access:read"],
622 ["create_deploy_key", "access:admin"],
623 ["delete_deploy_key", "access:admin"],
Inbox: the events service tells people what needs them as events arrive624 ["list_webhooks", "webhooks:read"],
625 ["list_webhook_deliveries", "webhooks:read"],
626 ["create_webhook", "webhooks:admin"],
627 ["update_webhook", "webhooks:admin"],
628 ["delete_webhook", "webhooks:admin"],
629 ["ping_webhook", "webhooks:admin"],
630 ["redeliver_webhook", "webhooks:admin"],
631 ["list_actions_secrets", "secrets:read"],
632 ["list_actions_variables", "secrets:read"],
633 ["set_actions_secret", "secrets:admin"],
634 ["delete_actions_secret", "secrets:admin"],
635 ["set_actions_variable", "secrets:admin"],
636 ["delete_actions_variable", "secrets:admin"],
637 // Self-hosted runners.
638 ["list_runners", "runners:read"],
639 ["list_runner_groups", "runners:read"],
640 ["get_runner_settings", "runners:read"],
641 ["create_runner_registration_token", "runners:admin"],
642 ["remove_runner", "runners:admin"],
643 ["create_runner_group", "runners:admin"],
644 ["update_runner_group", "runners:admin"],
645 ["delete_runner_group", "runners:admin"],
646 ["update_runner_settings", "runners:admin"],
Merge packages: roles, Actions access, source label, soft delete, API647 // Packages: reading them, their versions and who may use them needs
648 // `packages:read`; changing their settings, access and Manage Actions
649 // access `packages:write` (and the Admin role on the package, which the
650 // packages service checks); deleting and restoring packages and
651 // versions `packages:delete`, as the registries' own deletes do.
652 ["list_packages", "packages:read"],
653 ["get_package", "packages:read"],
654 ["list_package_versions", "packages:read"],
655 ["get_package_version", "packages:read"],
656 ["list_package_access", "packages:read"],
657 ["list_package_actions_access", "packages:read"],
658 ["update_package", "packages:write"],
659 ["link_package", "packages:write"],
660 ["unlink_package", "packages:write"],
661 ["set_package_access", "packages:write"],
662 ["remove_package_access", "packages:write"],
663 ["set_package_actions_access", "packages:write"],
664 ["remove_package_actions_access", "packages:write"],
665 ["delete_package", "packages:delete"],
666 ["restore_package", "packages:delete"],
667 ["delete_package_version", "packages:delete"],
668 ["restore_package_version", "packages:delete"],
Merge main into Artifacts Phase 2669 // Artifacts mode's docs, slides, designs and dashboards (the `artifact`
The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook.670 // MCP tool). The artifacts service then checks the person's role on each.
Merge main into Artifacts Phase 2671 ["list_workspace_artifacts", "artifacts:read"],
672 ["search_workspace_artifacts", "artifacts:read"],
673 ["get_workspace_artifact", "artifacts:read"],
674 ["get_workspace_artifact_content", "artifacts:read"],
675 ["list_workspace_artifact_versions", "artifacts:read"],
676 ["get_workspace_artifact_access", "artifacts:read"],
677 ["list_workspace_artifact_templates", "artifacts:read"],
678 ["list_workspace_artifact_spaces", "artifacts:read"],
679 ["query_workspace_dataset", "artifacts:read"],
680 ["create_workspace_artifact", "artifacts:write"],
681 ["update_workspace_artifact", "artifacts:write"],
682 ["edit_workspace_artifact", "artifacts:write"],
683 ["trash_workspace_artifact", "artifacts:write"],
684 ["restore_workspace_artifact", "artifacts:write"],
685 ["restore_workspace_artifact_version", "artifacts:write"],
686 ["set_workspace_artifact_access", "artifacts:admin"],
687 ["purge_workspace_artifact", "artifacts:admin"],
Inbox: the events service tells people what needs them as events arrive688] as const;
689
690/**
691 * The scopes a token or grant holds, as stored: null for full access, or
692 * the list. `legacy` marks a token made before scopes, which has full
693 * access until someone narrows it.
694 */
695export type TokenScopes = {
696 scopes: Scope[] | null;
697 legacy: boolean;
698};
699
700/**
701 * How settings group scopes into a checklist: each group's scopes, least
702 * first. Admin scopes are not here; they are under "Dangerous" on their
703 * own (see `DANGEROUS_SCOPES`). Every other scope is in exactly one group.
704 */
705export const SCOPE_GROUPS: { id: string; label: string; scopes: Scope[] }[] = [
706 { id: "code", label: "Repositories & code", scopes: ["repo:read", "repo:write", "code:read", "code:write"] },
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar707 { id: "security", label: "Security", scopes: ["security:read", "security:write"] },
Inbox: the events service tells people what needs them as events arrive708 { id: "packages", label: "Packages", scopes: ["packages:read", "packages:write"] },
709 { id: "work", label: "Issues & pull requests", scopes: ["issues:read", "issues:write", "pull_requests:read", "pull_requests:write"] },
Token reach: workflow_files scope, fine-grained reach, workspace token cap710 { id: "workflows", label: "Workflows", scopes: ["workflows:read", "workflows:write", "workflow_files:write"] },
Merge checks: statuses and check runs on every commit711 { id: "checks", label: "Checks", scopes: ["checks:read", "checks:write"] },
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97712 { id: "deployments", label: "Deployments", scopes: ["deployments:read", "deployments:write"] },
Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry.713 { id: "observability", label: "Observability", scopes: ["observability:read", "observability:write"] },
Inbox: the events service tells people what needs them as events arrive714 { id: "account", label: "Account", scopes: ["account:read", "account:write"] },
API: notifications over REST and MCP, with notifications scopes715 { id: "notifications", label: "Notifications", scopes: ["notifications:read", "notifications:write"] },
The phone app: Chat in full with phone notifications, plus Code and Customize (#4)716 { id: "chat", label: "Chat", scopes: ["chat:read", "chat:write"] },
Inbox: the events service tells people what needs them as events arrive717 { id: "workspace", label: "Workspace", scopes: ["workspace:read", "access:read", "webhooks:read", "secrets:read"] },
Usage, Billing settings and prepaid AI credit; fixes from the UX audit718 { id: "billing", label: "Billing", scopes: ["billing:read", "billing:write"] },
Inbox: the events service tells people what needs them as events arrive719 { id: "runners", label: "Runners", scopes: ["runners:read"] },
Merge main into Artifacts Phase 2720 { id: "artifacts", label: "Artifacts", scopes: ["artifacts:read", "artifacts:write"] },
Inbox: the events service tells people what needs them as events arrive721];
722
723/** The admin and delete scopes, shown under "Dangerous" behind a warning. */
724export const DANGEROUS_SCOPES: Scope[] = SCOPES.map((row) => row.scope).filter(isDangerous);

This file's history is long; its oldest lines are credited to the oldest commit read.