Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 1 | /** |
| 2 | * Scopes: what an access token may do on its owner's behalf. Mirrors | |
| 3 | * `crates/contracts/src/scopes.rs`, which is the source of truth; a Rust | |
| 4 | * test keeps the tables here the same. | |
| 5 | * | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 6 | * A token's permissions are its scopes read per resource: each resource |
| 7 | * at none or one level, such as issues: write. What a request may do is | |
| 8 | * the intersection of the owner's role, the token's reach (the workspace | |
| 9 | * it is made for, and its repositories) and its permissions. | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 10 | */ |
| 11 | ||
| 12 | export type ScopeResource = | |
| 13 | | "repo" | |
| 14 | | "code" | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 15 | | "security" |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 16 | | "packages" |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 17 | | "issues" |
| 18 | | "pull_requests" | |
| 19 | | "agents" | |
| 20 | | "workflows" | |
| Token reach: workflow_files scope, fine-grained reach, workspace token cap | 21 | | "workflow_files" |
| Merge checks: statuses and check runs on every commit | 22 | | "checks" |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 23 | | "deployments" |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 24 | | "observability" |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 25 | | "memory" |
| 26 | | "account" | |
| API: notifications over REST and MCP, with notifications scopes | 27 | | "notifications" |
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 28 | | "chat" |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 29 | | "workspace" |
| Usage, Billing settings and prepaid AI credit; fixes from the UX audit | 30 | | "billing" |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 31 | | "access" |
| 32 | | "webhooks" | |
| 33 | | "secrets" | |
| Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens | 34 | | "runners" |
| Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet | 35 | | "models" |
| 36 | | "artifacts"; | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 37 | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 38 | export type ScopeLevel = "read" | "write" | "run" | "delete" | "admin"; |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 39 | |
| 40 | /** Every scope, grouped by resource, least first. */ | |
| 41 | export const SCOPES = [ | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 42 | { scope: "repo:read", description: "See repositories, their settings, labels, timelines, releases, languages, contributors and security alerts, and search" }, |
| The Branches page does things to branches now. It has tabs (Overview, Yours, Active, Stale, All, kept in the address as ?tab=) and search; Overview shows the default branch, then the first five of your branches, the active ones and the stale ones, each linking to the rest. Each branch is a row with its name in a code chip with a copy button, who made its latest commit and when, that commit's checks, behind and ahead counts with bars drawn against the largest shown, and its pull request (the open one, else the newest merged or closed) with its state; on a phone the columns fold under the name. Yours is branches whose latest commit is the viewer's; stale is no commit in 90 days. | 43 | { scope: "repo:write", description: "Create repositories, create, rename and delete branches, change how pull requests merge and publish releases" }, |
| Merge rulesets: branch and tag rules, agent-first, enforced on push and merge | 44 | { scope: "repo:admin", description: "Rename, archive, transfer, delete or change who can see a repository, change its rulesets, and dismiss security alerts" }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 45 | { scope: "code:read", description: "Clone and fetch private repositories with git" }, |
| 46 | { scope: "code:write", description: "Push commits with git" }, | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 47 | { scope: "security:read", description: "See secret scanning, code scanning and vulnerability alerts, custom patterns, the dependency graph and SBOM, and security settings" }, |
| 48 | { scope: "security:write", description: "Dismiss and reopen alerts, bypass push protection, review bypass requests, manage custom patterns, upload SARIF and change security settings" }, | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 49 | { scope: "packages:read", description: "Pull container images and install private packages" }, |
| 50 | { scope: "packages:write", description: "Push container images and publish packages" }, | |
| Merge packages: roles, Actions access, source label, soft delete, API | 51 | { scope: "packages:delete", description: "Delete and restore packages and their versions" }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 52 | { scope: "issues:read", description: "Read issues, comments and plans" }, |
| 53 | { scope: "issues:write", description: "Open, edit, close and comment on issues" }, | |
| 54 | { scope: "pull_requests:read", description: "Read pull requests, their changes, sessions and merge queues" }, | |
| 55 | { scope: "pull_requests:write", description: "Open, review, close and merge pull requests" }, | |
| 56 | { scope: "agents:run", description: "Put g1t agents to work and message them, which uses the workspace's money" }, | |
| 57 | { scope: "workflows:read", description: "Read workflows, runs and logs" }, | |
| 58 | { scope: "workflows:write", description: "Run, cancel, rerun and turn workflows on or off" }, | |
| Token reach: workflow_files scope, fine-grained reach, workspace token cap | 59 | { scope: "workflow_files:write", description: "Add, change and delete workflow files under .g1t/workflows and .github/workflows, with git or the API" }, |
| Merge checks: statuses and check runs on every commit | 60 | { scope: "checks:read", description: "Read commits' statuses, check runs, check suites and annotations" }, |
| 61 | { scope: "checks:write", description: "Report statuses and check runs on commits, and ask for checks to run again" }, | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 62 | { scope: "deployments:read", description: "See deployments, their statuses and environments" }, |
| 63 | { scope: "deployments:write", description: "Report deployments and their statuses, from any CI" }, | |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 64 | { scope: "observability:read", description: "See projects' requests, logs, traces, errors and metrics, and their observability settings, ingest tokens and exports" }, |
| 65 | { scope: "observability:write", description: "Resolve and ignore errors, and change projects' observability settings, ingest tokens and exports" }, | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 66 | { scope: "memory:read", description: "Recall memory and search the workspace's context" }, |
| 67 | { scope: "memory:write", description: "Save memory for the next agent" }, | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 68 | { scope: "account:read", description: "Read your email addresses, invites, invitations, pinned projects and stars" }, |
| 69 | { scope: "account:write", description: "Change your email addresses, make invites, answer invitations, pin projects and star repositories" }, | |
| API: notifications over REST and MCP, with notifications scopes | 70 | { scope: "notifications:read", description: "See your inbox, its threads, and what you subscribe to and watch" }, |
| 71 | { scope: "notifications:write", description: "Mark notifications read, done, saved or snoozed, subscribe to threads and watch repositories" }, | |
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 72 | { scope: "chat:read", description: "Read the conversations you are in: channels, direct messages, threads and reactions, live" }, |
| 73 | { scope: "chat:write", description: "Send, edit and delete your messages, react, mark conversations read, and answer cards in chat" }, | |
| Merge rulesets: branch and tag rules, agent-first, enforced on push and merge | 74 | { scope: "workspace:read", description: "Read workspace settings, invites, integrations, model routes, teams and rulesets" }, |
| 75 | { scope: "workspace:admin", description: "Create and delete workspaces, invite members, connect integrations, create, change and delete teams, and change the workspace's rulesets" }, | |
| Usage, Billing settings and prepaid AI credit; fixes from the UX audit | 76 | { scope: "billing:read", description: "See a workspace's usage, budget, AI credit and invoices" }, |
| 77 | { scope: "billing:write", description: "Change a workspace's budget and buy AI credit" }, | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 78 | { scope: "access:read", description: "See who has access to repositories" }, |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 79 | { scope: "access:admin", description: "Give and take away access to repositories, a team's included" }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 80 | { scope: "webhooks:read", description: "See webhooks and their deliveries" }, |
| 81 | { scope: "webhooks:admin", description: "Create, change and delete webhooks" }, | |
| 82 | { scope: "secrets:read", description: "List secrets (never their values) and read variables" }, | |
| 83 | { scope: "secrets:admin", description: "Set and delete secrets and variables" }, | |
| 84 | { scope: "runners:read", description: "See self-hosted runners, their groups and where agents run" }, | |
| 85 | { scope: "runners:admin", description: "Register and remove self-hosted runners, change their groups and settings" }, | |
| Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens | 86 | { scope: "models:read", description: "See the workspace's AI Gateway requests: their models, tokens, cost and status" }, |
| 87 | { scope: "models:write", description: "Send model requests through the AI Gateway, which uses the workspace's AI credit" }, | |
| Merge main into Artifacts Phase 2 | 88 | { scope: "artifacts:read", description: "List, read and search artifacts you can see, their versions, and the numbers their dashboards show" }, |
| 89 | { scope: "artifacts:write", description: "Create, rename, move, edit, trash and restore artifacts, and propose changes to them" }, | |
| 90 | { scope: "artifacts:admin", description: "Share artifacts, change who can open them, and delete them for good" }, | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 91 | ] as const; |
| 92 | ||
| Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet | 93 | /** |
| 94 | * Scopes of resources being built that tokens are not offered yet (Rust: | |
| 95 | * `Resource::offered`). They parse in Rust and are typed here, but no | |
| 96 | * preset, full access, OAuth request or token form hands them out, and no | |
| 97 | * operation needs them. When one ships, its rows move to the end of | |
| Merge main into Artifacts Phase 2 | 98 | * `SCOPES` and `SCOPE_RESOURCES`. Empty now: Artifacts shipped last. |
| Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet | 99 | */ |
| Merge main into Artifacts Phase 2 | 100 | export const UPCOMING_SCOPES: readonly { scope: Scope; description: string }[] = [ |
| Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet | 101 | ] as const; |
| 102 | ||
| Merge main into Artifacts Phase 2 | 103 | export type Scope = (typeof SCOPES)[number]["scope"]; |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 104 | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 105 | /** Where a resource sits on the token form; only a person's token may hold account ones. */ |
| 106 | export type ResourceGroup = "repository" | "workspace" | "account"; | |
| 107 | ||
| 108 | /** Resources in the order settings show them, with their names for people and their group. */ | |
| 109 | export const SCOPE_RESOURCES: { resource: ScopeResource; label: string; group: ResourceGroup }[] = [ | |
| 110 | { resource: "repo", label: "Repositories", group: "repository" }, | |
| 111 | { resource: "code", label: "Code", group: "repository" }, | |
| 112 | { resource: "security", label: "Security", group: "repository" }, | |
| 113 | { resource: "packages", label: "Packages", group: "repository" }, | |
| 114 | { resource: "issues", label: "Issues", group: "repository" }, | |
| 115 | { resource: "pull_requests", label: "Pull requests", group: "repository" }, | |
| 116 | { resource: "agents", label: "g1t agents", group: "repository" }, | |
| 117 | { resource: "workflows", label: "Workflows", group: "repository" }, | |
| 118 | { resource: "workflow_files", label: "Workflow files", group: "repository" }, | |
| 119 | { resource: "checks", label: "Checks and statuses", group: "repository" }, | |
| 120 | { resource: "deployments", label: "Deployments", group: "repository" }, | |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 121 | { resource: "observability", label: "Observability", group: "repository" }, |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 122 | { resource: "memory", label: "Memory and context", group: "repository" }, |
| 123 | { resource: "account", label: "Your account", group: "account" }, | |
| 124 | { resource: "notifications", label: "Notifications", group: "account" }, | |
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 125 | { resource: "chat", label: "Chat", group: "account" }, |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 126 | { resource: "workspace", label: "Workspaces", group: "workspace" }, |
| 127 | { resource: "billing", label: "Billing", group: "workspace" }, | |
| 128 | { resource: "access", label: "Who has access", group: "repository" }, | |
| 129 | { resource: "webhooks", label: "Webhooks", group: "repository" }, | |
| 130 | { resource: "secrets", label: "Secrets and variables", group: "repository" }, | |
| 131 | { resource: "runners", label: "Self-hosted runners", group: "workspace" }, | |
| 132 | { resource: "models", label: "AI Gateway", group: "workspace" }, | |
| Merge main into Artifacts Phase 2 | 133 | { resource: "artifacts", label: "Artifacts", group: "workspace" }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 134 | ]; |
| 135 | ||
| Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet | 136 | /** Resources not offered yet, as `UPCOMING_SCOPES`: settings never show them. */ |
| 137 | export const UPCOMING_RESOURCES: { resource: ScopeResource; label: string; group: ResourceGroup }[] = [ | |
| 138 | ]; | |
| 139 | ||
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 140 | const LEVEL_ORDER: Record<ScopeLevel, number> = { read: 0, write: 1, run: 2, delete: 3, admin: 4 }; |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 141 | |
| 142 | export function scopeResource(scope: Scope): ScopeResource { | |
| 143 | return scope.split(":")[0] as ScopeResource; | |
| 144 | } | |
| 145 | ||
| 146 | export function scopeLevel(scope: Scope): ScopeLevel { | |
| 147 | return scope.split(":")[1] as ScopeLevel; | |
| 148 | } | |
| 149 | ||
| 150 | export function isScope(text: string): text is Scope { | |
| 151 | return SCOPES.some((row) => row.scope === text); | |
| 152 | } | |
| 153 | ||
| 154 | /** Changes that are hard to undo, or decide who can reach what. */ | |
| 155 | export function isDangerous(scope: Scope): boolean { | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 156 | const level = scopeLevel(scope); |
| 157 | return level === "admin" || level === "delete"; | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 158 | } |
| 159 | ||
| 160 | export function describeScope(scope: Scope): string { | |
| Artifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet | 161 | return [...SCOPES, ...UPCOMING_SCOPES].find((row) => row.scope === scope)?.description ?? scope; |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 162 | } |
| 163 | ||
| 164 | /** Whether holding `held` gives `needed`: the same resource, at its level or lower. */ | |
| 165 | export function scopeIncludes(held: Scope, needed: Scope): boolean { | |
| 166 | return ( | |
| 167 | scopeResource(held) === scopeResource(needed) && | |
| 168 | LEVEL_ORDER[scopeLevel(held)] >= LEVEL_ORDER[scopeLevel(needed)] | |
| 169 | ); | |
| 170 | } | |
| 171 | ||
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 172 | /** |
| 173 | * Whether a token holding `scopes` may do what `needed` gates (Rust: | |
| 174 | * `TokenAccess::allows`). Null or absent scopes are full access, which | |
| 175 | * holds every scope; unknown names give nothing. | |
| 176 | */ | |
| 177 | export function tokenAllows(scopes: readonly string[] | null | undefined, needed: Scope): boolean { | |
| 178 | if (scopes === null || scopes === undefined) return true; | |
| 179 | return scopes.some((held) => isScope(held) && scopeIncludes(held, needed)); | |
| 180 | } | |
| 181 | ||
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 182 | /** The levels a resource has, least first. */ |
| 183 | export function levelsOf(resource: ScopeResource): ScopeLevel[] { | |
| 184 | return SCOPES.filter((row) => scopeResource(row.scope) === resource).map((row) => scopeLevel(row.scope)); | |
| 185 | } | |
| 186 | ||
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 187 | /** The token form's groups, in order. */ |
| 188 | export const RESOURCE_GROUPS: { group: ResourceGroup; label: string; about: string }[] = [ | |
| 189 | { group: "repository", label: "Repository permissions", about: "What it may do in the repositories it reaches." }, | |
| 190 | { group: "workspace", label: "Workspace permissions", about: "What it may do with the workspaces it reaches themselves." }, | |
| 191 | { group: "account", label: "Account permissions", about: "What it may do with your own account. Personal tokens only." }, | |
| 192 | ]; | |
| 193 | ||
| 194 | /** A token's permissions: each resource held, at its highest level; left out is none. */ | |
| 195 | export type Permissions = Partial<Record<ScopeResource, ScopeLevel>>; | |
| 196 | ||
| 197 | /** Scopes as permissions. Null scopes (full access) are every resource at its highest. */ | |
| 198 | export function permissionsOf(scopes: readonly string[] | null): Permissions { | |
| 199 | const permissions: Permissions = {}; | |
| 200 | const held = scopes === null ? SCOPES.map((row) => row.scope) : parseScopes(scopes.join(" ")); | |
| 201 | for (const scope of held) { | |
| 202 | const resource = scopeResource(scope); | |
| 203 | const now = permissions[resource]; | |
| 204 | if (!now || LEVEL_ORDER[scopeLevel(scope)] > LEVEL_ORDER[now]) permissions[resource] = scopeLevel(scope); | |
| 205 | } | |
| 206 | return permissions; | |
| 207 | } | |
| 208 | ||
| 209 | /** Permissions as the scopes a token stores: the highest of each resource, in table order. */ | |
| 210 | export function scopesOfPermissions(permissions: Permissions): Scope[] { | |
| 211 | const wanted = new Set( | |
| 212 | Object.entries(permissions) | |
| 213 | .filter(([, level]) => level) | |
| 214 | .map(([resource, level]) => `${resource}:${level}`), | |
| 215 | ); | |
| 216 | return SCOPES.map((row) => row.scope).filter((scope) => wanted.has(scope)); | |
| 217 | } | |
| 218 | ||
| 219 | /** The longest a token with an expiry may last, in days. */ | |
| 220 | export const MAX_TOKEN_LIFETIME_DAYS = 366; | |
| 221 | ||
| 222 | /** The most repositories a token may select. */ | |
| 223 | export const MAX_SELECTED_REPOSITORIES = 50; | |
| 224 | ||
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 225 | /** Scopes from text separated by spaces or commas, in table order; unknown ones are left out. */ |
| 226 | export function parseScopes(text: string): Scope[] { | |
| 227 | const given = new Set(text.split(/[\s,]+/).map((part) => part.trim().toLowerCase())); | |
| 228 | return SCOPES.map((row) => row.scope).filter((scope) => given.has(scope)); | |
| 229 | } | |
| 230 | ||
| 231 | /** What a token stores for full access. */ | |
| 232 | export const FULL_ACCESS = "*"; | |
| 233 | ||
| 234 | export type PresetId = "read_only" | "agent" | "ci" | "full"; | |
| 235 | ||
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 236 | /** Starting points for choosing scopes. `*` is full access. No preset gives chat: an application gets it only by asking for it. */ |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 237 | export const PRESET_SCOPES = { |
| 238 | read_only: [ | |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 239 | "repo:read", "code:read", "security:read", "packages:read", "issues:read", "pull_requests:read", "workflows:read", "checks:read", "deployments:read", "observability:read", "memory:read", "account:read", "notifications:read", "workspace:read", "billing:read", "access:read", "webhooks:read", "secrets:read", "runners:read", "models:read", "artifacts:read", |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 240 | ] as const, |
| 241 | agent: [ | |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 242 | "repo:read", "code:read", "code:write", "security:read", "packages:read", "issues:read", "issues:write", "pull_requests:read", "pull_requests:write", "agents:run", "workflows:read", "checks:read", "deployments:read", "observability:read", "memory:read", "memory:write", "account:read", "notifications:read", "notifications:write", "workspace:read", "billing:read", "access:read", "webhooks:read", "secrets:read", "models:read", "artifacts:read", |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 243 | ] as const, |
| 244 | ci: [ | |
| Merge checks: statuses and check runs on every commit | 245 | "repo:read", "code:read", "code:write", "packages:read", "packages:write", "workflows:read", "workflows:write", "checks:read", "checks:write", "deployments:read", "deployments:write", |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 246 | ] as const, |
| 247 | full: [ | |
| 248 | "*", | |
| 249 | ] as const, | |
| 250 | }; | |
| 251 | ||
| 252 | export const PRESETS: { id: PresetId; label: string; description: string }[] = [ | |
| 253 | { id: "read_only", label: "Read only", description: "Read everything you can read; change nothing." }, | |
| 254 | { id: "agent", label: "Agent", description: "Read everything, work on issues and pull requests, push code and run g1t agents." }, | |
| Merge checks: statuses and check runs on every commit | 255 | { id: "ci", label: "CI", description: "Clone and push code, push and pull packages, run workflows, and report checks and deployments." }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 256 | { id: "full", label: "Full access", description: "Everything you can do, including deleting repositories and changing who has access." }, |
| 257 | ]; | |
| 258 | ||
| 259 | /** The scopes of a preset, or null for full access. */ | |
| 260 | export function presetScopes(id: PresetId): Scope[] | null { | |
| 261 | if (id === "full") return null; | |
| 262 | return [...PRESET_SCOPES[id]] as Scope[]; | |
| 263 | } | |
| 264 | ||
| 265 | /** What an OAuth client gets when it asks for nothing in particular. */ | |
| 266 | export const OAUTH_DEFAULT_SCOPES: Scope[] = [...PRESET_SCOPES.agent]; | |
| 267 | ||
| 268 | /** The operation each scope gates, by the API's operation names. */ | |
| 269 | export const OPERATION_SCOPES = [ | |
| 270 | ["list_emails", "account:read"], | |
| 271 | ["add_email", "account:write"], | |
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 272 | ["confirm_email", "account:write"], |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 273 | ["remove_email", "account:write"], |
| 274 | ["update_email_settings", "account:write"], | |
| 275 | ["list_invites", "account:read"], | |
| 276 | ["create_invite", "account:write"], | |
| 277 | ["revoke_invite", "account:write"], | |
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 278 | ["list_invitations", "account:read"], |
| 279 | ["accept_invitation", "account:write"], | |
| 280 | ["decline_invitation", "account:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 281 | ["list_my_repo_invitations", "account:read"], |
| 282 | ["accept_repo_invitation", "account:write"], | |
| 283 | ["decline_repo_invitation", "account:write"], | |
| API: pinned projects over REST and MCP | 284 | // Your pinned projects: a preference of your account. |
| 285 | ["list_pinned_projects", "account:read"], | |
| 286 | ["pin_project", "account:write"], | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 287 | // Your stars: a preference of your account. |
| 288 | ["list_starred", "account:read"], | |
| 289 | ["check_starred", "account:read"], | |
| 290 | ["star_repo", "account:write"], | |
| 291 | ["unstar_repo", "account:write"], | |
| API: pinned projects over REST and MCP | 292 | ["unpin_project", "account:write"], |
| 293 | ["reorder_pinned_projects", "account:write"], | |
| API: notifications over REST and MCP, with notifications scopes | 294 | // Your inbox: notifications, subscriptions and watching. |
| 295 | ["list_notifications", "notifications:read"], | |
| 296 | ["get_notification_thread", "notifications:read"], | |
| 297 | ["get_thread_subscription", "notifications:read"], | |
| 298 | ["get_repo_subscription", "notifications:read"], | |
| 299 | ["list_watched_repos", "notifications:read"], | |
| 300 | ["mark_notifications_read", "notifications:write"], | |
| 301 | ["mark_thread_read", "notifications:write"], | |
| 302 | ["mark_thread_done", "notifications:write"], | |
| 303 | ["save_thread", "notifications:write"], | |
| 304 | ["snooze_thread", "notifications:write"], | |
| 305 | ["set_thread_subscription", "notifications:write"], | |
| 306 | ["delete_thread_subscription", "notifications:write"], | |
| 307 | ["set_repo_subscription", "notifications:write"], | |
| 308 | ["delete_repo_subscription", "notifications:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 309 | ["create_workspace", "workspace:admin"], |
| 310 | ["delete_workspace", "workspace:admin"], | |
| Merge branch 'worktree-agent-ad7c6d88d93adc817' | 311 | ["get_workspace", "workspace:read"], |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 312 | ["update_workspace", "workspace:admin"], |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 313 | ["list_members", "workspace:read"], |
| 314 | ["update_member", "workspace:admin"], | |
| 315 | ["remove_member", "workspace:admin"], | |
| 316 | ["transfer_ownership", "workspace:admin"], | |
| 317 | ["leave_workspace", "account:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 318 | ["list_workspace_invites", "workspace:read"], |
| 319 | ["invite_member", "workspace:admin"], | |
| 320 | ["revoke_workspace_invite", "workspace:admin"], | |
| 321 | ["list_integrations", "workspace:read"], | |
| 322 | ["connect_integration", "workspace:admin"], | |
| AI Gateway: OpenAI's format, open models, and your own providers | 323 | ["update_integration", "workspace:admin"], |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 324 | ["disconnect_integration", "workspace:admin"], |
| 325 | ["test_integration", "workspace:admin"], | |
| 326 | ["get_model_routes", "workspace:read"], | |
| 327 | ["set_model_routes", "workspace:admin"], | |
| Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9 | 328 | ["list_marketplaces", "workspace:read"], |
| 329 | ["add_marketplace", "workspace:admin"], | |
| 330 | ["remove_marketplace", "workspace:admin"], | |
| 331 | ["refresh_marketplace", "workspace:admin"], | |
| 332 | ["discover", "workspace:read"], | |
| 333 | ["list_plugins", "workspace:read"], | |
| 334 | ["get_plugin", "workspace:read"], | |
| 335 | ["install_plugin", "workspace:admin"], | |
| 336 | ["set_plugin_enabled", "workspace:admin"], | |
| 337 | ["uninstall_plugin", "workspace:admin"], | |
| 338 | ["update_plugin", "workspace:admin"], | |
| 339 | ["list_plugin_agents", "workspace:read"], | |
| 340 | ["list_connectors", "workspace:read"], | |
| 341 | ["get_connector", "workspace:read"], | |
| 342 | ["add_connector", "workspace:admin"], | |
| 343 | ["set_connector_key", "workspace:admin"], | |
| 344 | ["remove_connector", "workspace:admin"], | |
| 345 | ["refresh_connector", "workspace:admin"], | |
| 346 | ["grant_connector", "workspace:admin"], | |
| 347 | ["revoke_connector", "workspace:admin"], | |
| 348 | ["customize_bundle", "agents:run"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 349 | ["list_teams", "workspace:read"], |
| 350 | ["get_team", "workspace:read"], | |
| 351 | ["list_team_members", "workspace:read"], | |
| 352 | ["list_child_teams", "workspace:read"], | |
| 353 | ["list_team_repos", "workspace:read"], | |
| 354 | ["list_user_teams", "workspace:read"], | |
| 355 | ["create_team", "workspace:admin"], | |
| Merge rulesets: branch and tag rules, agent-first, enforced on push and merge | 356 | ["list_workspace_rulesets", "workspace:read"], |
| 357 | ["get_workspace_ruleset", "workspace:read"], | |
| 358 | ["list_workspace_rule_evaluations", "workspace:read"], | |
| 359 | ["create_workspace_ruleset", "workspace:admin"], | |
| 360 | ["update_workspace_ruleset", "workspace:admin"], | |
| 361 | ["delete_workspace_ruleset", "workspace:admin"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 362 | ["update_team", "workspace:admin"], |
| 363 | ["delete_team", "workspace:admin"], | |
| 364 | ["set_team_member", "workspace:admin"], | |
| 365 | ["remove_team_member", "workspace:admin"], | |
| 366 | ["set_team_review_assignment", "workspace:admin"], | |
| Usage, Billing settings and prepaid AI credit; fixes from the UX audit | 367 | // A workspace's billing: usage, budget, AI credit and invoices. |
| 368 | ["get_usage", "billing:read"], | |
| 369 | ["get_budget", "billing:read"], | |
| 370 | ["get_ai_credit", "billing:read"], | |
| 371 | ["list_invoices", "billing:read"], | |
| 372 | ["get_billing_details", "billing:read"], | |
| 373 | ["set_budget", "billing:write"], | |
| 374 | ["buy_ai_credit", "billing:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 375 | ["list_repos", "repo:read"], |
| 376 | ["get_repo", "repo:read"], | |
| Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's. | 377 | ["download_tarball_archive", "code:read"], |
| 378 | ["download_zipball_archive", "code:read"], | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 379 | // Projects follow their repositories. |
| 380 | ["list_projects", "repo:read"], | |
| 381 | ["get_project", "repo:read"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 382 | ["search", "repo:read"], |
| 383 | ["list_events", "repo:read"], | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 384 | // What the default branch says about a repository, who starred it, and |
| 385 | // its releases. | |
| 386 | ["get_languages", "repo:read"], | |
| 387 | ["list_contributors", "repo:read"], | |
| 388 | ["get_license", "repo:read"], | |
| 389 | ["list_stargazers", "repo:read"], | |
| 390 | ["list_releases", "repo:read"], | |
| 391 | ["get_latest_release", "repo:read"], | |
| 392 | ["get_release_by_tag", "repo:read"], | |
| 393 | ["get_release", "repo:read"], | |
| 394 | ["create_release", "repo:write"], | |
| 395 | ["update_release", "repo:write"], | |
| 396 | ["delete_release", "repo:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 397 | ["list_labels", "repo:read"], |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 398 | ["list_milestones", "repo:read"], |
| 399 | ["get_milestone", "repo:read"], | |
| 400 | ["create_label", "issues:write"], | |
| 401 | ["update_label", "issues:write"], | |
| 402 | ["delete_label", "issues:write"], | |
| 403 | ["add_default_labels", "issues:write"], | |
| 404 | ["create_milestone", "issues:write"], | |
| 405 | ["update_milestone", "issues:write"], | |
| 406 | ["delete_milestone", "issues:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 407 | ["get_repo_settings", "repo:read"], |
| 408 | ["list_check_names", "repo:read"], | |
| 409 | ["list_deleted_repos", "repo:read"], | |
| 410 | ["list_security_alerts", "repo:read"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 411 | ["get_codeowners_errors", "repo:read"], |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 412 | ["create_repo", "repo:write"], |
| 413 | ["update_repo", "repo:write"], | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 414 | ["update_project", "repo:write"], |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 415 | ["update_repo_settings", "repo:write"], |
| Merge rulesets: branch and tag rules, agent-first, enforced on push and merge | 416 | ["list_repo_rulesets", "repo:read"], |
| 417 | ["get_repo_ruleset", "repo:read"], | |
| 418 | ["get_branch_rules", "repo:read"], | |
| 419 | ["list_rule_evaluations", "repo:read"], | |
| 420 | ["create_repo_ruleset", "repo:admin"], | |
| 421 | ["update_repo_ruleset", "repo:admin"], | |
| 422 | ["delete_repo_ruleset", "repo:admin"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 423 | ["rename_branch", "repo:write"], |
| The Branches page does things to branches now. It has tabs (Overview, Yours, Active, Stale, All, kept in the address as ?tab=) and search; Overview shows the default branch, then the first five of your branches, the active ones and the stale ones, each linking to the rest. Each branch is a row with its name in a code chip with a copy button, who made its latest commit and when, that commit's checks, behind and ahead counts with bars drawn against the largest shown, and its pull request (the open one, else the newest merged or closed) with its state; on a phone the columns fold under the name. Yours is branches whose latest commit is the viewer's; stale is no commit in 90 days. | 424 | ["create_branch", "repo:write"], |
| 425 | ["delete_branch", "repo:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 426 | ["rename_repo", "repo:admin"], |
| 427 | ["transfer_repo", "repo:admin"], | |
| 428 | ["archive_repo", "repo:admin"], | |
| 429 | ["unarchive_repo", "repo:admin"], | |
| 430 | ["set_repo_visibility", "repo:admin"], | |
| 431 | ["delete_repo", "repo:admin"], | |
| 432 | ["restore_repo", "repo:admin"], | |
| 433 | ["purge_repo", "repo:admin"], | |
| 434 | ["dismiss_security_alert", "repo:admin"], | |
| 435 | ["reopen_security_alert", "repo:admin"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 436 | // The security suite. |
| 437 | ["list_secret_scanning_alerts", "security:read"], | |
| 438 | ["get_secret_scanning_alert", "security:read"], | |
| 439 | ["list_secret_scanning_locations", "security:read"], | |
| 440 | ["list_bypass_requests", "security:read"], | |
| 441 | ["list_custom_patterns", "security:read"], | |
| 442 | ["list_code_scanning_alerts", "security:read"], | |
| 443 | ["get_code_scanning_alert", "security:read"], | |
| 444 | ["list_code_scanning_analyses", "security:read"], | |
| 445 | ["get_sarif_upload", "security:read"], | |
| 446 | ["list_vulnerability_alerts", "security:read"], | |
| 447 | ["get_vulnerability_alert", "security:read"], | |
| 448 | ["get_dependency_graph", "security:read"], | |
| 449 | ["get_sbom", "security:read"], | |
| 450 | ["compare_dependencies", "security:read"], | |
| 451 | ["get_security_settings", "security:read"], | |
| 452 | ["get_workspace_security_settings", "security:read"], | |
| 453 | ["get_security_overview", "security:read"], | |
| Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9 | 454 | ["list_security_advisories", "security:read"], |
| 455 | ["get_security_advisory", "security:read"], | |
| 456 | ["list_vulnerability_reports", "security:read"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 457 | ["update_secret_scanning_alert", "security:write"], |
| 458 | ["bypass_push_protection", "security:write"], | |
| 459 | ["check_secret_validity", "security:write"], | |
| 460 | ["review_bypass_request", "security:write"], | |
| 461 | ["create_custom_pattern", "security:write"], | |
| 462 | ["update_custom_pattern", "security:write"], | |
| 463 | ["delete_custom_pattern", "security:write"], | |
| 464 | ["dry_run_custom_pattern", "security:write"], | |
| 465 | ["update_code_scanning_alert", "security:write"], | |
| 466 | ["upload_sarif", "security:write"], | |
| 467 | ["update_vulnerability_alert", "security:write"], | |
| 468 | ["fix_security_alert", "security:write"], | |
| 469 | ["update_security_settings", "security:write"], | |
| 470 | ["update_workspace_security_settings", "security:write"], | |
| Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9 | 471 | ["create_security_advisory", "security:write"], |
| 472 | ["update_security_advisory", "security:write"], | |
| 473 | ["set_security_advisory_state", "security:write"], | |
| 474 | ["report_vulnerability", "security:write"], | |
| 475 | ["review_vulnerability_report", "security:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 476 | ["list_issues", "issues:read"], |
| 477 | ["get_issue", "issues:read"], | |
| 478 | ["get_plan", "issues:read"], | |
| 479 | ["create_issue", "issues:write"], | |
| 480 | ["update_issue", "issues:write"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 481 | ["list_issue_labels", "issues:read"], |
| 482 | ["add_issue_labels", "issues:write"], | |
| 483 | ["set_issue_labels", "issues:write"], | |
| 484 | ["remove_issue_labels", "issues:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 485 | ["close_issue", "issues:write"], |
| 486 | ["reopen_issue", "issues:write"], | |
| 487 | ["add_comment", "issues:write"], | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 488 | ["edit_comment", "issues:write"], |
| 489 | ["delete_comment", "issues:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 490 | ["import_issue", "issues:write"], |
| 491 | ["apply_plan", "issues:write"], | |
| 492 | ["list_pull_requests", "pull_requests:read"], | |
| 493 | ["get_pull_request", "pull_requests:read"], | |
| 494 | ["get_pull_request_changes", "pull_requests:read"], | |
| 495 | ["read_session", "pull_requests:read"], | |
| 496 | ["get_merge_queue", "pull_requests:read"], | |
| 497 | ["create_pull_request", "pull_requests:write"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 498 | ["update_pull_request", "pull_requests:write"], |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 499 | ["record_session", "pull_requests:write"], |
| 500 | ["mark_pull_request_ready", "pull_requests:write"], | |
| 501 | ["close_pull_request", "pull_requests:write"], | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 502 | ["reopen_pull_request", "pull_requests:write"], |
| 503 | ["convert_pull_request_to_draft", "pull_requests:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 504 | ["review_pull_request", "pull_requests:write"], |
| 505 | ["merge_pull_request", "pull_requests:write"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 506 | ["request_reviewers", "pull_requests:write"], |
| 507 | ["remove_requested_reviewers", "pull_requests:write"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 508 | ["assign_issue", "agents:run"], |
| 509 | ["delegate", "agents:run"], | |
| 510 | ["plan_work", "agents:run"], | |
| 511 | ["message_agent", "agents:run"], | |
| 512 | ["answer_message", "agents:run"], | |
| CI is green again: the agent computer landed with its five operations in the Rust scope table but not the TypeScript mirror, and with its shell and files switched on while the ability tests still expected every computer ability to be coming. The mirror lists them under agents:run, and the tests say what ships: commands run when asked for and files change on its own, while the browser and web search are still coming. | 513 | // A workspace agent's own computer: waking it spends the workspace's |
| 514 | // money, so the same scope covers reading and managing it. | |
| 515 | ["get_agent_computer", "agents:run"], | |
| 516 | ["wake_agent_computer", "agents:run"], | |
| 517 | ["sleep_agent_computer", "agents:run"], | |
| 518 | ["reset_agent_computer", "agents:run"], | |
| 519 | ["list_agent_computer_commands", "agents:run"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 520 | ["take_messages", "agents:run"], |
| 521 | ["list_workflows", "workflows:read"], | |
| 522 | ["list_workflow_runs", "workflows:read"], | |
| 523 | ["get_workflow_run", "workflows:read"], | |
| 524 | ["get_job_logs", "workflows:read"], | |
| 525 | ["dispatch_workflow", "workflows:write"], | |
| 526 | ["cancel_workflow_run", "workflows:write"], | |
| 527 | ["rerun_workflow_run", "workflows:write"], | |
| 528 | ["update_workflow", "workflows:write"], | |
| Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2 | 529 | ["list_artifacts", "workflows:read"], |
| 530 | ["list_workflow_run_artifacts", "workflows:read"], | |
| 531 | ["get_artifact", "workflows:read"], | |
| 532 | ["download_artifact", "workflows:read"], | |
| 533 | ["get_artifact_retention", "workflows:read"], | |
| 534 | ["delete_artifact", "workflows:write"], | |
| 535 | ["set_artifact_retention", "workflows:write"], | |
| Merge checks: statuses and check runs on every commit | 536 | ["list_commit_statuses", "checks:read"], |
| 537 | ["get_combined_status", "checks:read"], | |
| 538 | ["list_check_runs_for_ref", "checks:read"], | |
| 539 | ["get_check_run", "checks:read"], | |
| 540 | ["list_check_run_annotations", "checks:read"], | |
| 541 | ["list_check_suites_for_ref", "checks:read"], | |
| 542 | ["get_check_suite", "checks:read"], | |
| 543 | ["create_commit_status", "checks:write"], | |
| 544 | ["create_check_run", "checks:write"], | |
| 545 | ["update_check_run", "checks:write"], | |
| 546 | ["rerequest_check_run", "checks:write"], | |
| 547 | ["rerequest_check_suite", "checks:write"], | |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 548 | // Deployments, wherever they run: reading them, and reporting them. |
| 549 | ["list_deployments", "deployments:read"], | |
| 550 | ["get_deployment", "deployments:read"], | |
| 551 | ["list_deployment_statuses", "deployments:read"], | |
| 552 | ["list_environments", "deployments:read"], | |
| 553 | ["get_environment", "deployments:read"], | |
| 554 | ["create_deployment", "deployments:write"], | |
| 555 | ["create_deployment_status", "deployments:write"], | |
| Merge branch 'worktree-agent-a4d35ee70c50683d0' into claude/cool-newton-7nm8r9 | 556 | ["start_deployment_build", "deployments:write"], |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 557 | // Observability: what a project's software did, and how it is collected. |
| 558 | ["get_observability_overview", "observability:read"], | |
| 559 | ["list_requests", "observability:read"], | |
| 560 | ["get_request", "observability:read"], | |
| 561 | ["list_logs", "observability:read"], | |
| 562 | ["list_traces", "observability:read"], | |
| 563 | ["get_trace", "observability:read"], | |
| 564 | ["list_errors", "observability:read"], | |
| 565 | ["list_metrics", "observability:read"], | |
| 566 | ["get_metric", "observability:read"], | |
| 567 | ["get_observability_settings", "observability:read"], | |
| 568 | ["list_ingest_tokens", "observability:read"], | |
| 569 | ["list_telemetry_exports", "observability:read"], | |
| 570 | ["get_observability_usage", "observability:read"], | |
| 571 | ["update_error", "observability:write"], | |
| 572 | ["update_observability_settings", "observability:write"], | |
| 573 | ["create_ingest_token", "observability:write"], | |
| 574 | ["delete_ingest_token", "observability:write"], | |
| 575 | ["create_telemetry_export", "observability:write"], | |
| 576 | ["update_telemetry_export", "observability:write"], | |
| 577 | ["delete_telemetry_export", "observability:write"], | |
| Merge branch 'worktree-agent-a3abfcce648e87dca' | 578 | // What keeps runs safe: the runs environments hold and reviewing them, |
| 579 | // approving a pull request's run, and a repository's own rules for its | |
| 580 | // environments and tokens, which are an admin's. | |
| 581 | ["get_pending_deployments", "workflows:read"], | |
| 582 | ["review_pending_deployments", "workflows:write"], | |
| 583 | ["approve_workflow_run", "workflows:write"], | |
| 584 | ["get_workflow_permissions", "repo:read"], | |
| 585 | ["get_fork_pr_approval", "repo:read"], | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 586 | ["get_actions_access", "repo:read"], |
| Merge branch 'worktree-agent-a3abfcce648e87dca' | 587 | ["update_environment", "repo:admin"], |
| 588 | ["delete_environment", "repo:admin"], | |
| 589 | ["set_workflow_permissions", "repo:admin"], | |
| 590 | ["set_fork_pr_approval", "repo:admin"], | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 591 | ["set_actions_access", "repo:admin"], |
| Merge branch 'worktree-agent-a3abfcce648e87dca' | 592 | // Starting workflows from outside, as a push would. |
| 593 | ["create_repository_dispatch", "code:write"], | |
| 594 | // A workspace's policy for its repositories' tokens. | |
| 595 | ["get_workspace_workflow_permissions", "workspace:read"], | |
| 596 | ["set_workspace_workflow_permissions", "workspace:admin"], | |
| Merge GitHub pull request #8 (claude/cool-newton-7nm8r9): Docker deployments on g1t.page behind a switch that stays off until Cloudflare's container APIs are checked live, workflows a workspace manages in its repositories, tarball and zipball downloads, refs/pull/* kept to g1t alone, framework detection for g1t.page builds, and a workflow's event payload matching GitHub's. | 597 | ["list_workspace_managed_workflows", "workspace:read"], |
| 598 | ["create_workspace_managed_workflow", "workspace:admin"], | |
| 599 | ["update_workspace_managed_workflow", "workspace:admin"], | |
| 600 | ["delete_workspace_managed_workflow", "workspace:admin"], | |
| API and MCP for a workspace's personal access token rules, members' tokens and approvals | 601 | // A workspace's rules for personal access tokens, and its members' tokens. |
| 602 | ["get_token_policy", "workspace:read"], | |
| 603 | ["set_token_policy", "workspace:admin"], | |
| 604 | ["list_member_tokens", "access:read"], | |
| 605 | ["list_token_requests", "access:read"], | |
| 606 | ["review_token_request", "access:admin"], | |
| 607 | ["revoke_member_token", "access:admin"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 608 | ["recall", "memory:read"], |
| 609 | ["search_context", "memory:read"], | |
| 610 | ["get_entity", "memory:read"], | |
| 611 | ["get_context", "memory:read"], | |
| 612 | ["remember", "memory:write"], | |
| 613 | ["list_collaborators", "access:read"], | |
| 614 | ["get_collaborator_permission", "access:read"], | |
| 615 | ["list_repo_invitations", "access:read"], | |
| 616 | ["list_outside_collaborators", "access:read"], | |
| 617 | ["add_collaborator", "access:admin"], | |
| 618 | ["update_collaborator", "access:admin"], | |
| 619 | ["remove_collaborator", "access:admin"], | |
| 620 | ["revoke_repo_invitation", "access:admin"], | |
| 621 | ["set_base_permission", "access:admin"], | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 622 | ["set_team_repo", "access:admin"], |
| 623 | ["remove_team_repo", "access:admin"], | |
| Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca | 624 | ["list_deploy_keys", "access:read"], |
| 625 | ["get_deploy_key", "access:read"], | |
| 626 | ["create_deploy_key", "access:admin"], | |
| 627 | ["delete_deploy_key", "access:admin"], | |
| Merge branch 'mirroring' into artifacts-mode | 628 | ["get_mirror", "repo:read"], |
| 629 | ["sync_mirror", "code:write"], | |
| 630 | ["get_hand_back_plan", "repo:admin"], | |
| 631 | ["take_over_mirror", "repo:admin"], | |
| 632 | ["set_ci_failover", "repo:admin"], | |
| 633 | ["hand_back_mirror", "repo:admin"], | |
| 634 | ["move_mirror_to_g1t", "repo:admin"], | |
| 635 | ["add_mirror_remote", "repo:admin"], | |
| 636 | ["update_mirror_remote", "repo:admin"], | |
| 637 | ["remove_mirror_remote", "repo:admin"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 638 | ["list_webhooks", "webhooks:read"], |
| 639 | ["list_webhook_deliveries", "webhooks:read"], | |
| 640 | ["create_webhook", "webhooks:admin"], | |
| 641 | ["update_webhook", "webhooks:admin"], | |
| 642 | ["delete_webhook", "webhooks:admin"], | |
| 643 | ["ping_webhook", "webhooks:admin"], | |
| 644 | ["redeliver_webhook", "webhooks:admin"], | |
| 645 | ["list_actions_secrets", "secrets:read"], | |
| 646 | ["list_actions_variables", "secrets:read"], | |
| 647 | ["set_actions_secret", "secrets:admin"], | |
| 648 | ["delete_actions_secret", "secrets:admin"], | |
| 649 | ["set_actions_variable", "secrets:admin"], | |
| 650 | ["delete_actions_variable", "secrets:admin"], | |
| 651 | // Self-hosted runners. | |
| 652 | ["list_runners", "runners:read"], | |
| 653 | ["list_runner_groups", "runners:read"], | |
| 654 | ["get_runner_settings", "runners:read"], | |
| 655 | ["create_runner_registration_token", "runners:admin"], | |
| 656 | ["remove_runner", "runners:admin"], | |
| 657 | ["create_runner_group", "runners:admin"], | |
| 658 | ["update_runner_group", "runners:admin"], | |
| 659 | ["delete_runner_group", "runners:admin"], | |
| 660 | ["update_runner_settings", "runners:admin"], | |
| Merge packages: roles, Actions access, source label, soft delete, API | 661 | // Packages: reading them, their versions and who may use them needs |
| 662 | // `packages:read`; changing their settings, access and Manage Actions | |
| 663 | // access `packages:write` (and the Admin role on the package, which the | |
| 664 | // packages service checks); deleting and restoring packages and | |
| 665 | // versions `packages:delete`, as the registries' own deletes do. | |
| 666 | ["list_packages", "packages:read"], | |
| 667 | ["get_package", "packages:read"], | |
| 668 | ["list_package_versions", "packages:read"], | |
| 669 | ["get_package_version", "packages:read"], | |
| 670 | ["list_package_access", "packages:read"], | |
| 671 | ["list_package_actions_access", "packages:read"], | |
| 672 | ["update_package", "packages:write"], | |
| 673 | ["link_package", "packages:write"], | |
| 674 | ["unlink_package", "packages:write"], | |
| 675 | ["set_package_access", "packages:write"], | |
| 676 | ["remove_package_access", "packages:write"], | |
| 677 | ["set_package_actions_access", "packages:write"], | |
| 678 | ["remove_package_actions_access", "packages:write"], | |
| 679 | ["delete_package", "packages:delete"], | |
| 680 | ["restore_package", "packages:delete"], | |
| 681 | ["delete_package_version", "packages:delete"], | |
| 682 | ["restore_package_version", "packages:delete"], | |
| Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens | 683 | // The AI Gateway. Sending a request to a model needs `models:write`, |
| 684 | // checked by the model proxy at models.g1t.sh. | |
| 685 | ["list_gateway_requests", "models:read"], | |
| Merge main into Artifacts Phase 2 | 686 | // Artifacts mode's docs, slides, designs and dashboards (the `artifact` |
| The artifacts service is services/artifacts, the Worker g1t-artifacts, bound as ARTIFACTS by the API, the site and the agents; its live rooms move to it with a Durable Object transfer from g1t-docs-service, and its database, bucket, indexes and queue keep their names. The git store's binding and settings are GITSTORE, its ops scripts gitstore-*, and workflow run artifacts keep their compatible API under run_artifacts modules. The deploy tool puts a Worker that has never deployed before the Workers in its stage that bind to it, and the deploy guide gives the cutover runbook. | 687 | // MCP tool). The artifacts service then checks the person's role on each. |
| Merge main into Artifacts Phase 2 | 688 | ["list_workspace_artifacts", "artifacts:read"], |
| 689 | ["search_workspace_artifacts", "artifacts:read"], | |
| 690 | ["get_workspace_artifact", "artifacts:read"], | |
| 691 | ["get_workspace_artifact_content", "artifacts:read"], | |
| 692 | ["list_workspace_artifact_versions", "artifacts:read"], | |
| 693 | ["get_workspace_artifact_access", "artifacts:read"], | |
| 694 | ["list_workspace_artifact_templates", "artifacts:read"], | |
| 695 | ["list_workspace_artifact_spaces", "artifacts:read"], | |
| 696 | ["query_workspace_dataset", "artifacts:read"], | |
| 697 | ["create_workspace_artifact", "artifacts:write"], | |
| 698 | ["update_workspace_artifact", "artifacts:write"], | |
| 699 | ["edit_workspace_artifact", "artifacts:write"], | |
| 700 | ["trash_workspace_artifact", "artifacts:write"], | |
| 701 | ["restore_workspace_artifact", "artifacts:write"], | |
| 702 | ["restore_workspace_artifact_version", "artifacts:write"], | |
| 703 | ["set_workspace_artifact_access", "artifacts:admin"], | |
| 704 | ["purge_workspace_artifact", "artifacts:admin"], | |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 705 | ] as const; |
| 706 | ||
| 707 | /** | |
| 708 | * The scopes a token or grant holds, as stored: null for full access, or | |
| 709 | * the list. `legacy` marks a token made before scopes, which has full | |
| 710 | * access until someone narrows it. | |
| 711 | */ | |
| 712 | export type TokenScopes = { | |
| 713 | scopes: Scope[] | null; | |
| 714 | legacy: boolean; | |
| 715 | }; | |
| 716 | ||
| 717 | /** | |
| 718 | * How settings group scopes into a checklist: each group's scopes, least | |
| 719 | * first. Admin scopes are not here; they are under "Dangerous" on their | |
| 720 | * own (see `DANGEROUS_SCOPES`). Every other scope is in exactly one group. | |
| 721 | */ | |
| 722 | export const SCOPE_GROUPS: { id: string; label: string; scopes: Scope[] }[] = [ | |
| 723 | { id: "code", label: "Repositories & code", scopes: ["repo:read", "repo:write", "code:read", "code:write"] }, | |
| Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar | 724 | { id: "security", label: "Security", scopes: ["security:read", "security:write"] }, |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 725 | { id: "packages", label: "Packages", scopes: ["packages:read", "packages:write"] }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 726 | { id: "work", label: "Issues & pull requests", scopes: ["issues:read", "issues:write", "pull_requests:read", "pull_requests:write"] }, |
| 727 | { id: "agents", label: "Agents", scopes: ["agents:run"] }, | |
| Token reach: workflow_files scope, fine-grained reach, workspace token cap | 728 | { id: "workflows", label: "Workflows", scopes: ["workflows:read", "workflows:write", "workflow_files:write"] }, |
| Merge checks: statuses and check runs on every commit | 729 | { id: "checks", label: "Checks", scopes: ["checks:read", "checks:write"] }, |
| Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97 | 730 | { id: "deployments", label: "Deployments", scopes: ["deployments:read", "deployments:write"] }, |
| Projects have Observability: their requests, logs, traces, metrics and errors, from apps on g1t.page with nothing to set up, and from software anywhere else over OpenTelemetry. | 731 | { id: "observability", label: "Observability", scopes: ["observability:read", "observability:write"] }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 732 | { id: "memory", label: "Memory & search", scopes: ["memory:read", "memory:write"] }, |
| 733 | { id: "account", label: "Account", scopes: ["account:read", "account:write"] }, | |
| API: notifications over REST and MCP, with notifications scopes | 734 | { id: "notifications", label: "Notifications", scopes: ["notifications:read", "notifications:write"] }, |
| The phone app: Chat in full with phone notifications, plus Code and Customize (#4) | 735 | { id: "chat", label: "Chat", scopes: ["chat:read", "chat:write"] }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 736 | { id: "workspace", label: "Workspace", scopes: ["workspace:read", "access:read", "webhooks:read", "secrets:read"] }, |
| Usage, Billing settings and prepaid AI credit; fixes from the UX audit | 737 | { id: "billing", label: "Billing", scopes: ["billing:read", "billing:write"] }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 738 | { id: "runners", label: "Runners", scopes: ["runners:read"] }, |
| Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens | 739 | { id: "models", label: "AI Gateway", scopes: ["models:read", "models:write"] }, |
| Merge main into Artifacts Phase 2 | 740 | { id: "artifacts", label: "Artifacts", scopes: ["artifacts:read", "artifacts:write"] }, |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 741 | ]; |
| 742 | ||
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 743 | /** The admin and delete scopes, shown under "Dangerous" behind a warning. */ |
| Cleanup: clippy is quiet outside billing, the README says g1t, and http-cache-semantics is 4.3.0 | 744 | export const DANGEROUS_SCOPES: Scope[] = SCOPES.map((row) => row.scope).filter(isDangerous); |
This file's history is long; its oldest lines are credited to the oldest commit read.