crates/contracts/src · flagon-io/g1t

workMerge remote-tracking branch 'g1t/main' into HEAD2d ago

about.rsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

access.rsOnly projects have descriptions now; a repository no longer keeps one of its own (#45 ). Every repository already had a project of its own name, which showed the repository's description until it was given another, so the same line lived in two places with two settings pages. Now:2d ago

account_deletion.rsOne kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers1w ago

accounts.rsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

actions.rsMerge branch 'forking': repository forking, pull request merge methods and every repository setting for pull requests, commits, pushes and issues2d ago

advisories.rsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

agent_sessions.rsMerge branch 'main' of https://g1t.sh/flagon-io/g1t2d ago

agents.rsMerge branch 'worktree-agent-a4babc5b5815f6f3a'4d ago

ai.rsMerge branch 'main' into worktree-agent-a654d8ba46392bedd2d ago

audit.rsMerge main into Artifacts Phase 21w ago

backups.rsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

billing.rsMerge main into project-descriptions2d ago

checks.rsA required check named for a workflow job, as GitHub's branch rules name them, is met by that job. Each g1t Actions job on a pull request's head counts as a check of its name (`test`, `build (ubuntu-latest, 22)`, or `deploy / build` for a called workflow's job), from the latest attempt of its workflow: skipped passes, cancelled fails, and a job still going holds the merge. So a ruleset or required check copied from GitHub needs no renaming, and one that names the workflow, such as `CI`, is met by the whole run as before. This holds in the merge box, for the merge queue and for agents' merges; jobs count only toward required checks, so a `continue-on-error` job that fails doesn't send an agent back. The pull requests guide says so.5d ago

codeowners.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1w ago

coding_agents.rsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

credentials.rsA session g1t starts on Claude Managed Agents acts as g1t for the person who started it: on flagon-io/demo #1 the session closed the issue and the timeline said "syntaqx closed this as completed", because its token was a plain personal access token for @syntaqx (create_access_token, scoped to the repository), so every comment, close, review and pull request it made read as theirs. It now holds a run credential of a new kind, session (credentials::RunCredentialKind::Session, made by identity's create_run_credential, up to 12 hours, revoked when the session ends as before): it resolves to g1t on behalf of the person, may use every API and MCP operation credentials::SESSION_SCOPES allow (the scopes the old token had) and never one in NEVER, in its repository only, with the person's role there capped at Write, and pushes with git to that repository (any branch, so a new repository's first version still goes to its default branch) and to the working copies of its pull requests (decide_git_at, resolved by repos from the fork's source). Past the API and git it is the person with acting kept (as_person), so the session, its claims, its pull requests' forks and its pushes stay theirs and their role decides, while what it writes is recorded as g1t's for them: issues and pull requests it opens are g1t's, requested by them (work::authorship), and its comments, reviews and the events it notes (close, reopen, labels, assignees, milestones, blocked-by, ready, draft) are written as g1t with acting_for the person (work rows::By, into the acting_for columns of migration 0033), shown as "g1t ... on behalf of @syntaqx" on the issue and pull request pages; the person can still edit them, and a session's approval counts only where agents' approvals do. The system prompt says the token is g1t's for that person. The sessions guide and the identity architecture page say what a session acts as. Deploy order: every Worker that reads a viewer (api, repos, work, packages, events, identity and the rest) before integrations, which is the only one that makes the new kind; no migration. Checked: cargo test -p g1t-contracts (316) -p g1t-work (201) -p g1t-identity (183) -p g1t-integrations (76) -p g1t-repos (363) -p g1t-api (209) -p g1t-packages (112); cargo check --target wasm32-unknown-unknown of g1t-work, g1t-identity, g1t-integrations, g1t-repos, g1t-api, g1t-packages; apps/web tsc -b shows no errors in components/work.tsx (the rest need typegen).2d ago

datasets.rsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

decisions.rs`why` no longer hands out commit authors' email addresses. Why a line is the way it is (API why, MCP repository why) returned the blamed commit as git stores it, author address included, to anyone who can read the repository. Its commit is now a WhyCommit: the author is named as git wrote them and by `username`, the g1t account their address belongs to (a confirmed or noreply address, or g1t's own), as list_commits already does, and the address is never returned. The guide, the operation's description, its example and the OpenAPI document say so. Checked: cargo test for g1t-contracts (new: an author is named by account, never by address) and g1t-api (204, the OpenAPI document regenerated), the CLI's (149), cargo check --workspace and g1t-api's wasm32 build.3d ago

deploy_keys.rsMerge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca1w ago

events.rsWhat a session's push closes is g1t's, for the person: on flagon-io/session-lab #1 the session g1t started pushed its first version with Closes #1 , and the issue closed as it should, but its timeline said "syntaqx closed this in 20d5574 via session …", because the git.push event carries only the pusher's id (the person, for a session's token), so work wrote the close as theirs. repos now says on git.push which agent pushed for the person (GitPush::agent, from the viewer's acting, on HTTPS pushes, landings and pushes made on g1t), and work writes the close note as g1t with acting_for the pusher when it is set; a close through the API keeps following its caller (rows::By). Deploy: repos and work together. Checked: cargo test -p g1t-contracts (316) -p g1t-repos (364) -p g1t-work (203); wasm32 check of g1t-repos and g1t-work.2d ago

folios.rsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

github.rsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

guardrails.rsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

identity.rsMerge branch 'worktree-agent-ac7d6e0b40efe9fe8' into ship-batch2d ago

ids.rsHome says what people did as well as what agents did. Since you were last here now has a People column and an Agents column: who pushed how many commits to which projects, pull requests opened, merged and reviewed, issues opened and closed, docs edited, messages sent and deploys that went out, each line a link to where those are listed, with the agents' acceptance (first time, after review, didn't finish) kept as a row of their column; the sentence under the heading sums it up honestly, and says when a part of g1t could not be read, or that the span was quiet. Landed counts merged pull requests, commits pushed straight to a default branch, production deploys that went live, releases and packages, newest first; Running now adds workflow runs. Behind it, the events service answers an activity digest over a span in one round trip from its existing indexes, every push now records how many commits it carried, and chat counts the messages sent in the conversations you can read. The Home guide defines every line, and says how this scales.6d ago

inbox.rsMerge remote-tracking branch 'g1t/main' into HEAD2d ago

integrations.rsA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).2d ago

lib.rsA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).2d ago

live.rsg1t coordinates the work and the person's own sessions do it: Ask g1t reads g1t with the same tools any agent gets, answers in one conversation shared with the @g1t direct message in Chat, and hands work to sessions in the person's own harness, whose subagents g1t records, ties to issues and pull requests, and lets see each other.4d ago

members.rsBilling is ready to take real money, and stays on Stripe's test key until the switch. The g1t plan is $21 a month, all-in, with $10 of usage included: the card processing fee is part of the price, and no payment carries a fee line any more (old fee rows still read as they were). Card, billing address, tax IDs, invoices and cancelling are on Stripe's billing page (Manage billing), whose configuration billing keeps in step; Checkout asks for the billing address and a tax ID; g1t's Billing page keeps usage, the spend limit, budget alerts and prepaying. Members other than owners and billing managers no longer see billing details or invoices, from the page or the API.4d ago

names.rsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

outcome.rsMerge branch 'mirroring' into artifacts-mode1w ago

packages.rsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

people.rsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

projects.rsProjects: what a workspace builds and runs, first on every page1w ago

repos.rsA new repository's first push closes the issues its commits name: on flagon-io/demo the session pushed the first version with Closes #1 , and #1 stayed open, so the session closed it by hand. repos' pushed lists the commits a push brought in only when the branch existed before, since a new branch's commits were pushed elsewhere first; but the push that makes the default branch is the repository's first, and nothing was pushed before it. PushedArgs has first, which work sets for a push to the default branch with no before, and their messages count then. The pull requests guide says so under Closing issues. Checked: cargo test -p g1t-repos pushed (9, one new), cargo test -p g1t-work pushed (6).2d ago

rules.rsMerge branch 'worktree-agent-a57a81856918d70a7' into ship-batch2d ago

runners.rsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

scopes.rsThe Agent preset creates repositories, with a new repo:create scope (#52 )2d ago

search.rsg1t is the stored author of what it opens; the person who asked is requested_by and keeps the author's rights1w ago

security.rsMerge branch 'main' into ship-batch2d ago

security_suite.rsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

subscribers.rsMerge branch 'main' of https://g1t.sh/flagon-io/g1t2d ago

teams.rsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

time.rsFast pages, required checks on the branch, self-hosted runners, honest incidents1w ago

tokens.rsAn access token can be regenerated: a new secret, its name, permissions, repositories and reach kept, and the old secret refused at once. Its page (yours under Settings, a workspace's under its settings for owners) has Regenerate with a new expiry, within the workspace's rules on lifetime, and shows the secret once; identity's regenerate_token logs it to the security log or the workspace's audit log, and refuses a revoked token. The token form's quick permissions have All, every resource at its highest level. A project's Observability settings no longer list the token g1t gives its apps on g1t.page: it is g1t's, and the page says apps there need none.5d ago

updates.rsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1w ago

webhooks.rsMerge branch 'forking': repository forking, pull request merge methods and every repository setting for pull requests, commits, pushes and issues2d ago

work.rsA session g1t starts on Claude Managed Agents acts as g1t for the person who started it: on flagon-io/demo #1 the session closed the issue and the timeline said "syntaqx closed this as completed", because its token was a plain personal access token for @syntaqx (create_access_token, scoped to the repository), so every comment, close, review and pull request it made read as theirs. It now holds a run credential of a new kind, session (credentials::RunCredentialKind::Session, made by identity's create_run_credential, up to 12 hours, revoked when the session ends as before): it resolves to g1t on behalf of the person, may use every API and MCP operation credentials::SESSION_SCOPES allow (the scopes the old token had) and never one in NEVER, in its repository only, with the person's role there capped at Write, and pushes with git to that repository (any branch, so a new repository's first version still goes to its default branch) and to the working copies of its pull requests (decide_git_at, resolved by repos from the fork's source). Past the API and git it is the person with acting kept (as_person), so the session, its claims, its pull requests' forks and its pushes stay theirs and their role decides, while what it writes is recorded as g1t's for them: issues and pull requests it opens are g1t's, requested by them (work::authorship), and its comments, reviews and the events it notes (close, reopen, labels, assignees, milestones, blocked-by, ready, draft) are written as g1t with acting_for the person (work rows::By, into the acting_for columns of migration 0033), shown as "g1t ... on behalf of @syntaqx" on the issue and pull request pages; the person can still edit them, and a session's approval counts only where agents' approvals do. The system prompt says the token is g1t's for that person. The sessions guide and the identity architecture page say what a session acts as. Deploy order: every Worker that reads a viewer (api, repos, work, packages, events, identity and the rest) before integrations, which is the only one that makes the new kind; no migration. Checked: cargo test -p g1t-contracts (316) -p g1t-work (201) -p g1t-identity (183) -p g1t-integrations (76) -p g1t-repos (363) -p g1t-api (209) -p g1t-packages (112); cargo check --target wasm32-unknown-unknown of g1t-work, g1t-identity, g1t-integrations, g1t-repos, g1t-api, g1t-packages; apps/web tsc -b shows no errors in components/work.tsx (the rest need typegen).2d ago