packages/contracts/src · flagon-io/g1t

about.tsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

access.tsOnly projects have descriptions now; a repository no longer keeps one of its own (#45 ). Every repository already had a project of its own name, which showed the repository's description until it was given another, so the same line lived in two places with two settings pages. Now:2d ago

account-deletion.tsOne kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers1w ago

accounts.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

actions.tsMerge branch 'forking': repository forking, pull request merge methods and every repository setting for pull requests, commits, pushes and issues2d ago

advisories.tsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

agent-sessions.tsA session g1t starts on Claude Managed Agents answers in its card, not as you: on flagon-io/demo #1 the session's report showed in the thread as g1t's card, and then again as a comment by @syntaqx, because the kickoff told it to answer in the thread and its token is the person's, so every comment it posts reads as theirs. The kickoff, a follow-up comment passed to a running session (summon) and the system prompt now say the report is the answer, shown on the issue as the session's card, and never to post it or anything else as a comment. Plan mode gives its plan as the report rather than posting it (the mode hint and Ask's tool say so). Checked: cargo test -p g1t-integrations (76).2d ago

agents.tsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

ai.tsMerge branch 'main' into worktree-agent-a654d8ba46392bedd2d ago

audit.tsA session g1t starts on Claude Managed Agents acts as g1t for the person who started it: on flagon-io/demo #1 the session closed the issue and the timeline said "syntaqx closed this as completed", because its token was a plain personal access token for @syntaqx (create_access_token, scoped to the repository), so every comment, close, review and pull request it made read as theirs. It now holds a run credential of a new kind, session (credentials::RunCredentialKind::Session, made by identity's create_run_credential, up to 12 hours, revoked when the session ends as before): it resolves to g1t on behalf of the person, may use every API and MCP operation credentials::SESSION_SCOPES allow (the scopes the old token had) and never one in NEVER, in its repository only, with the person's role there capped at Write, and pushes with git to that repository (any branch, so a new repository's first version still goes to its default branch) and to the working copies of its pull requests (decide_git_at, resolved by repos from the fork's source). Past the API and git it is the person with acting kept (as_person), so the session, its claims, its pull requests' forks and its pushes stay theirs and their role decides, while what it writes is recorded as g1t's for them: issues and pull requests it opens are g1t's, requested by them (work::authorship), and its comments, reviews and the events it notes (close, reopen, labels, assignees, milestones, blocked-by, ready, draft) are written as g1t with acting_for the person (work rows::By, into the acting_for columns of migration 0033), shown as "g1t ... on behalf of @syntaqx" on the issue and pull request pages; the person can still edit them, and a session's approval counts only where agents' approvals do. The system prompt says the token is g1t's for that person. The sessions guide and the identity architecture page say what a session acts as. Deploy order: every Worker that reads a viewer (api, repos, work, packages, events, identity and the rest) before integrations, which is the only one that makes the new kind; no migration. Checked: cargo test -p g1t-contracts (316) -p g1t-work (201) -p g1t-identity (183) -p g1t-integrations (76) -p g1t-repos (363) -p g1t-api (209) -p g1t-packages (112); cargo check --target wasm32-unknown-unknown of g1t-work, g1t-identity, g1t-integrations, g1t-repos, g1t-api, g1t-packages; apps/web tsc -b shows no errors in components/work.tsx (the rest need typegen).2d ago

billing.tsMerge main into project-descriptions2d ago

chat-markdown.test.tsThe top of every page is one surface: the breadcrumb, search, spend, Ask g1t, bell and + share one height, corners and spacing, Ask g1t is a plain tinted button with the g1t mark drawn on whole pixels, a page's own header sits directly under the bar at the same left edge, and every section, conversations and open artifacts included, draws the same rounded panel. Tables written in chat render as tables, and the site's file, checkbox, radio, number and date controls are the design system's. Button, Separator, Breadcrumb, Table and FileDrop join the shared components; the chat guide says how tables work.1w ago

chat-markdown.tsThe top of every page is one surface: the breadcrumb, search, spend, Ask g1t, bell and + share one height, corners and spacing, Ask g1t is a plain tinted button with the g1t mark drawn on whole pixels, a page's own header sits directly under the bar at the same left edge, and every section, conversations and open artifacts included, draws the same rounded panel. Tables written in chat render as tables, and the site's file, checkbox, radio, number and date controls are the design system's. Button, Separator, Breadcrumb, Table and FileDrop join the shared components; the chat guide says how tables work.1w ago

chat.test.tsCards you act on in chat; agents comment and review as themselves; names shown cleanly; commits on the calendar1w ago

chat.tsAsk's card remembers what it did, step by step, on the answer that proposed it (#53 ): the card kept its progress only in the page that clicked it, so back in Chat the same answer offered Start session again, and a second click on the new-repository card opened a second issue and started a second session on the same empty repository (flagon-io/ask-hello-test got #1 and #2 , each with a session racing to push the first version). What a click does is now kept on the @g1t answer as it happens, in a proposal_state step beside the proposal: chat's new g1t_proposal merges it in (the viewer's own direct message with g1t only, known fields only) and tells the room, so every open copy of the answer updates. The card starts from it wherever the answer is read: Created with the repository, Live once the first version is pushed at with the address or Not deployed: with why, and Started with its links. Another click carries on from there rather than over: a session already started is shown, not started again; a repository already made, its deployments and the issue already opened are used; and while a click is still starting it (90 seconds at most), another says it's already starting. A failed step clears that hold so a retry works. Ask's steps also stop marking a read that found nothing as not read: checking that a new repository's name is free answers "not found", which showed as 1 not read on every new-repository answer.2d ago

checks.tsMerge checks: statuses and check runs on every commit1w ago

clients.tsMerge main into project-descriptions2d ago

codeowners.tsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1w ago

coding-agents.test.tsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

coding-agents.tsMerge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r95d ago

compute.tsMerge main into project-descriptions2d ago

connectors.test.tsA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).2d ago

connectors.tsA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).2d ago

d1.test.tsA doc opens at once: the page carries the document's saved state, so the editor mounts without waiting for its live room, which connects in the background and sends only what changed, with a quiet dot that turns green when it's synced; edits made before then are kept and sent once. The editor's code is preloaded from the page and fetched early when you hover a doc, the app's shared code ships in a few chunks instead of a hundred small ones, socket tickets come with the page instead of a round trip, and the artifacts service answers a page, a sidebar and a room in parallel lookups instead of a dozen in a row, reporting its database round trips in Server-Timing. The artifacts guide says how a doc opens, and CONTRIBUTING's Speed section has the numbers.1w ago

d1.tsA doc opens at once: the page carries the document's saved state, so the editor mounts without waiting for its live room, which connects in the background and sends only what changed, with a quiet dot that turns green when it's synced; edits made before then are kept and sent once. The editor's code is preloaded from the page and fetched early when you hover a doc, the app's shared code ships in a few chunks instead of a hundred small ones, socket tickets come with the page instead of a round trip, and the artifacts service answers a page, a sidebar and a room in parallel lookups instead of a dozen in a row, reporting its database round trips in Server-Timing. The artifacts guide says how a doc opens, and CONTRIBUTING's Speed section has the numbers.1w ago

datasets.fixtures.jsonArtifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet1w ago

datasets.test.tsArtifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet1w ago

datasets.tsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

deploy-keys.tsMerge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca1w ago

deployments.tsMerge remote-tracking branch 'g1t/main' into HEAD2d ago

discovery.test.tsThe phone app with your own g1t, on g1t.sh/download until Google Play, and Node 24 (#5 )6d ago

discovery.tsThe phone app with your own g1t, on g1t.sh/download until Google Play, and Node 24 (#5 )6d ago

docs.tsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

events.tsAn issue says what closed it, linked: on flagon-io/demo #1 the session that built the page closed the issue through the issue tool's close, and its timeline said only "syntaqx closed this as completed", with nothing to follow to the commit that did the work or the session that made it. close_issue (REST, the MCP issue tool's close, `g1t issue close --commit`) now takes an optional commit: one on the default branch (repos' log and branch_drift) whose message names the issue after a closing keyword (closing::references). The issue then closes as completed in that commit exactly as its push would (close_by_commit: resolved_commit, "closed this in <commit>", issue.closed with commit), by the caller; a commit not on the default branch, or one not naming the issue, is refused saying why, and an already-closed issue says what closed it. The work service's CloseIssueArgs flattens IssueActionArgs, so integrations and security keep calling close_issue as they do. When an issue is closed in a session, the note ends "via session ses_…" and issue.closed carries session: the session the closing commit names in a G1t-Session trailer (on a push too), or, for a close made with a token, the closer's own active session on the issue (attached or linked; the person it acts for when it acts for one). The timeline renders that id as a session chip linking /<owner>/<repo>/work/sessions/<id>, next to the existing commit chip and #N links (messageParts gains a session part). The pull requests guide's Closing issues, the sessions guide, webhooks, the API reference notes, openapi.json, the CLI reference and ops table say so. Deploy: work and api together, then the site; the CLI flag ships with the next CLI release. Checked: cargo test -p g1t-work (202), -p g1t-api (209, openapi regenerated), -p g1t-contracts, -p g1t (ops_table and cli_reference regenerated); wasm32 check of g1t-work and g1t-api; apps/web npm run typecheck; node --test app/lib/commit-message.test.ts.2d ago

folios-dashboard.tsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

folios-design.tsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

folios-slides.tsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

folios.fixtures.jsonArtifacts contracts: folios, their four kinds, dashboard datasets, folio events and the artifacts scopes are typed and validated the same in TypeScript and Rust, with nothing using them yet1w ago

folios.test.tsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

folios.tsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

github.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

guardrails.tsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

identity.tsMerge main into project-descriptions2d ago

ids.test.tsHome says what people did as well as what agents did. Since you were last here now has a People column and an Agents column: who pushed how many commits to which projects, pull requests opened, merged and reviewed, issues opened and closed, docs edited, messages sent and deploys that went out, each line a link to where those are listed, with the agents' acceptance (first time, after review, didn't finish) kept as a row of their column; the sentence under the heading sums it up honestly, and says when a part of g1t could not be read, or that the span was quiet. Landed counts merged pull requests, commits pushed straight to a default branch, production deploys that went live, releases and packages, newest first; Running now adds workflow runs. Behind it, the events service answers an activity digest over a span in one round trip from its existing indexes, every push now records how many commits it carried, and chat counts the messages sent in the conversations you can read. The Home guide defines every line, and says how this scales.6d ago

ids.tsMerge main into project-descriptions2d ago

inbox.tsMerge remote-tracking branch 'g1t/main' into HEAD2d ago

index.tsA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).2d ago

instances.tsMerge branch 'worktree-agent-a56293a6f836cd343'4d ago

integrations.tsA workspace's AI is its own setting, not an integration. AI providers and what Ask answers with were connections like Sentry's or Linear's: rows of `connections`, cards in the Integrations directory, `provider` values of the integration operations. Integrations are becoming a directory others publish to; a workspace's AI is a base setting g1t looks after itself. Contracts: `g1t_contracts::ai` (and packages/contracts ai.ts) has AiProvider (the 14), AiGroup (labs, platforms, self_hosted), AiConfig, AiConnection and their methods' arguments, and the Ask types moved there; AskSetup names the provider by `provider_id` and `provider_name` (were connection_id, connection_name). `integrations::Provider` is sentry, datadog, webhook, jira and linear; ProviderKind loses Models, ConnectionConfig its base_url, auth_header and model, Connection its models. Storage: integrations migration 0011 makes `ai_providers` and `ai_routes`, moves the AI rows out of `connections` with their ids (sealed keys are bound to the id, and managed_agents and agent_runs keep finding them), keeps Ask's route and drops `model_routes`; renaming and deleting a workspace cover both tables. The service keeps them in src/ai.rs with methods of their own (ai_list, ai_add, ai_update, ai_remove, ai_test, ask_settings, set_ask_settings, ask); a provider's key is checked when added and on each test; removing one turns Ask off when it answered with it and forgets its managed agent. Sessions on issues find the workspace's Anthropic provider there. API: list_ai_providers, add_ai_provider, update_ai_provider, remove_ai_provider, test_ai_provider (/workspaces/{workspace}/ai/providers[/{id}[/test]]), get_ask_settings and set_ask_settings (/workspaces/{workspace}/ai/ask), under the OpenAPI tag AI; reading takes workspace:read, changing workspace:admin and an owner's own token; the integration operations take only integration providers. MCP: a tool `ai` (list_providers, add_provider, update_provider, remove_provider, test_provider, get_ask, set_ask). The CLI's operation table and command reference are regenerated. Site: AI at /<workspace>/-/ai (the sidebar's AI → Models, the command palette's AI models) holds Ask g1t, the providers and Add a provider, grouped Frontier labs, Model platforms, Self-hosted or your own gateway; AI providers are no longer in the Integrations directory or Apps, and the integrations pages are alerts and trackers only; -/integrations/models and ?add=<an AI provider> lead to -/ai. Ask's settings link, and @g1t's "not set up yet" in Chat, point there. Docs: the AI providers guide (with its API), and the integrations, Ask, sessions, CLI, plugin and MCP pages say so. Deploy the integrations migration first, then integrations, then api, chat and web. Checked: cargo test for g1t-contracts (309), g1t-integrations (70), g1t-api (204, the OpenAPI document regenerated) and the CLI (105 and 44, the command reference current); cargo check --workspace; wasm32 checks of api and integrations; every migration applied in order to SQLite with an AI provider, a Sentry connection and Ask's route; the site's tsc -b --force, 927 tests and a production build; contracts' 48; chat's 76 and typecheck; the deploy tool's 92; the docs build (521 pages).2d ago

members.tsBilling is ready to take real money, and stays on Stripe's test key until the switch. The g1t plan is $21 a month, all-in, with $10 of usage included: the card processing fee is part of the price, and no payment carries a fee line any more (old fee rows still read as they were). Card, billing address, tax IDs, invoices and cancelling are on Stripe's billing page (Manage billing), whose configuration billing keeps in step; Checkout asks for the billing address and a tax ID; g1t's Billing page keeps usage, the spend limit, budget alerts and prepaying. Members other than owners and billing managers no longer see billing details or invoices, from the page or the API.4d ago

names.test.tsA workflow's `uses: actions/setup-node@v4` means GitHub's `actions` again, whoever is on g1t. g1t looked for a repository on g1t before GitHub, and anyone could make a public workspace called `actions`, `docker` or `aws-actions` and have its `setup-node` run in every workflow that names GitHub's, with that job's secrets. Now another workspace's public repository answers only for a name GitHub has no public repository of; the caller's own workspace and g1t's own `g1t/…` still answer from g1t, and when GitHub can't be asked, GitHub's is used. The names of the GitHub accounts whose actions workflows use most can no longer be registered, renamed to, or taken by signing up with GitHub (which suggests the name with `-gh`); an account that has one keeps it, and mentions and invitations still find it. The Actions, authentication and workspaces guides say so.5d ago

names.tsMerge branch 'worktree-agent-ac950b9c891220ad3'4d ago

notify.tsMerge remote-tracking branch 'g1t/main' into HEAD2d ago

oauth.tsOAuth 2.1 sign-in for MCP clients and other applications2w ago

og.tsMerge branch 'main' into worktree-agent-a654d8ba46392bedd2d ago

packages.tsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

people.tsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

platform.tsThe docs folder is gone, and what it held lives where people read it: how a self-hosted g1t runs and how to deploy g1t to Cloudflare are pages on docs.g1t.sh under Run g1t yourself, and speed, rate limits and operating g1t.sh are sections of CONTRIBUTING.md; code that cited a file in docs/ now points to the page or section that covers it, or says what it means itself, and applied migrations and the runner images are left as they were.1w ago

privacy.tsPersonal-data erasure has an intake, a staff case with its trail, and cleanup that identity commits with the purge and retries until each service confirms it; one-time-code fields work with password managers and take recovery codes; the Ask panel closes when you follow a link from it. Settings → Account records an erasure request (identity request_erasure / my_erasure, migration 0049), even when a workspace you own alone or billing stands in the way of closing the account; it deletes nothing, keeps the first deadline when asked again, and the deadline is the same day next calendar month, clamped to its last day. sudo → Customers → Privacy lists the cases (the sidebar counts open ones), records a request received elsewhere with its original receipt time (an intake for an open case joins its trail and can only move the deadline earlier), shows each case's trail of intake, reviews, refusal or completion, and refuses completion while the account or any of its cleanup jobs remain or any of the seven evidence areas is empty. Purging an account or a workspace now writes five purge jobs (avatar, Chat, Notify, Artifacts, the lifecycle event) in the same D1 batch as the deletion, guarded like every statement in it, so a restore that won leaves neither; the 15-minute tick runs them, keeps a failure pending with backoff to 16 hours, never stores a response body, and clears a done job's payload. Publishing user.deleted or workspace.deleted is delivery to the bus, not proof its consumers finished. A workspace's jobs carry its members at purge time and its former slugs no live workspace holds. Chat (migration 0006): the person's direct message with g1t goes with its answers and pending job; in shared conversations only the person is shut out and their messages show as ghost, where before the room's clear told every member's tab the conversation was emptied and dropped others' pending answers; a workspace's channels are deleted 500 messages at a time within a budget, answering pending until done; the channels to visit are listed once with the tombstone; tombstones, looked up by key with new indexes, refuse late messages, members, reactions, channels, settings, emoji and meter rows. Notify: an erased feed drops later deliveries quietly instead of throwing; a purged workspace's slug can be made again by the person whose username it is, so its marks are times, not bans: notifications from before the purge are dropped, counts, seeds and visits refused for a day, and its presence room refuses only words said before the purge; the purge reaches identity's members and the room's people under every slug, and clears complete:, forgot: and the workspace's notification level. Artifacts (migration 0010): unshared private folios and their files, versions, search rows and vectors go; authorship (now also cleared_by and repo_spaces.added_by) shows as ghost and mention lists drop the username; a workspace is swept a page at a time and resumes after a failure; full-text rows of a document are deleted by document; an index run that races an erasure writes no full-text row without a chunk row and takes back the vectors it wrote; a room's destroy waits for its index run; ordinary page deletion now destroys the page's live document. Not covered automatically, and listed in docs/operations/privacy-erasure.md as manual review: comment threads inside shared documents' live state and version snapshots, private-space pages, rooms of pages deleted before this, folio trash past 200 rooms, earlier folios' version and upload blobs, former members' and outsiders' notifications, backups. One-time codes: the sign-in's second step, two-factor settings and email confirmation share otpInputProps (lib/otp.ts): a stable id and label, autocomplete one-time-code, no password-manager ignore attributes; the sign-in field takes either kind of code at recovery-code length whichever is chosen, and Use a recovery code switches the keyboard. The Ask panel closes on every completed navigation (location.key), including its direct-message link and citations to the page you are on and back or forward; links opened in another tab and revalidation leave it open. The Privacy Policy distinguishes closure from erasure; the authentication guide says how to ask and how recovery codes are entered; the services page lists identity's new CHAT, NOTIFY and ARTIFACTS bindings. Deploy migrations first, then chat, notify and artifacts before identity, then web and sudo. Checked: cargo test -p g1t-identity --lib (175) and its wasm32 check; node --test conformance/erasure.test.mjs (11, new: a shared channel's room shuts out only the erased member, a large channel deleted in chunks with late writes refused, a reclaimed slug keeps new notifications and presence, vectors taken back after a racing erasure, an upload sweep resuming after a failure, late deliveries dropped quietly); artifacts' 126 tests and typecheck, notify's 49 and typecheck, chat's typecheck; the site's tsc -b --force, 926 tests (new: otp) and a production build; sudo's typecheck, 156 tests and build; contracts' 48; the deploy tool's tests (the one failure is services/runner/base.json, from separate uncommitted runner work); the docs build.3d ago

projects.tsOnly projects have descriptions now; a repository no longer keeps one of its own (#45 ). Every repository already had a project of its own name, which showed the repository's description until it was given another, so the same line lived in two places with two settings pages. Now:2d ago

rate-limits.tsg1t coordinates the work and the person's own sessions do it: Ask g1t reads g1t with the same tools any agent gets, answers in one conversation shared with the @g1t direct message in Chat, and hands work to sessions in the person's own harness, whose subagents g1t records, ties to issues and pull requests, and lets see each other.4d ago

repos.tsOnly projects have descriptions now; a repository no longer keeps one of its own (#45 ). Every repository already had a project of its own name, which showed the repository's description until it was given another, so the same line lived in two places with two settings pages. Now:2d ago

result.tsAn agent can put an image in a pull request, an issue or a comment without committing it: on flagon-io/session-lab #2 a cloud session asked to show a screenshot of its preview in the pull request's description found no way to upload one (not in g1t --help, g1t api --list or the docs), so it committed the PNG, linked it at that commit and removed it in a second commit. The site has no comment-image upload either; images only ever came from repository files. Now upload_attachment (POST /repos/{owner}/{repo}/attachments, issues:write, the issue tool's attach action over MCP) takes name, data (the file base64-encoded, as upload_sarif takes its file) and an optional content_type, and answers in snake_case with id, name, url, markdown (![name](url), ready to paste), content_type and size. The work service decides, as add_comment does: a confirmed account that can read the repository, which is not archived. The type is read from the bytes (PNG, JPEG, GIF or WebP; a content_type that says otherwise is refused), at most 10 MB; too large is the new FailureCode too_large (413), another type the new unsupported_type (415), in Rust and TS contracts and the OpenAPI error codes. The bytes go in the usercontent namespace (AVATARS, now bound to work) under attachments/<id>, where the id is 256 random bits so the address is its permission, as Docs files' is; a row in the new attachments table (migration 0048) names the repository, and repo.purged deletes the bytes, then the rows. The usercontent origin serves /attachments/<id> as it serves avatars (stored type, nosniff, sandboxed). The API forms url from USERCONTENT_URL as the site does (g1tusercontent.com for g1t.sh, SITE_URL/-/usercontent elsewhere; the self-host config now passes it to the API). The CLI has g1t attach FILE... (prints each image's Markdown; --json the fields, a list for several) and --attach FILE (repeatable) on g1t issue create, issue comment, pr create, pr comment and pr ready, which uploads and appends the Markdown after the text. A session's run credential gets upload_attachment through issues:write, bound to its own repository (tested), and the cloud session's system prompt says to upload screenshots with g1t attach and never commit images just to link them. Docs: the CLI guide (Images in descriptions and comments), pull requests (Images), sessions, the MCP reference, self-hosting's USERCONTENT_URL row, reference.json and the regenerated openapi.json, CLI ops table and CLI reference. Deploy order: apply work migration 0048 and deploy work (new AVATARS binding), then the site (usercontent serves /attachments), then api, then integrations (prompt) and the docs; g1t attach and --attach ship with the next CLI release, which cloud sessions need before the prompt's advice works. Checked: cargo test -p g1t-contracts (319), -p g1t-work (209), -p g1t-api (211; openapi regenerated with G1T_WRITE_OPENAPI), -p g1t (112 + 51; ops_table and cli_reference regenerated with G1T_WRITE_OPS and G1T_WRITE_DOCS), -p g1t-integrations (76); cargo check -p g1t-api, -p g1t-work and -p g1t-integrations --target wasm32-unknown-unknown; node --test apps/web/app/lib/token-scopes.test.ts.2d ago

rules.tsMerge branch 'forking': repository forking, pull request merge methods and every repository setting for pull requests, commits, pushes and issues2d ago

runners.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

scopes.tsAn agent can put an image in a pull request, an issue or a comment without committing it: on flagon-io/session-lab #2 a cloud session asked to show a screenshot of its preview in the pull request's description found no way to upload one (not in g1t --help, g1t api --list or the docs), so it committed the PNG, linked it at that commit and removed it in a second commit. The site has no comment-image upload either; images only ever came from repository files. Now upload_attachment (POST /repos/{owner}/{repo}/attachments, issues:write, the issue tool's attach action over MCP) takes name, data (the file base64-encoded, as upload_sarif takes its file) and an optional content_type, and answers in snake_case with id, name, url, markdown (![name](url), ready to paste), content_type and size. The work service decides, as add_comment does: a confirmed account that can read the repository, which is not archived. The type is read from the bytes (PNG, JPEG, GIF or WebP; a content_type that says otherwise is refused), at most 10 MB; too large is the new FailureCode too_large (413), another type the new unsupported_type (415), in Rust and TS contracts and the OpenAPI error codes. The bytes go in the usercontent namespace (AVATARS, now bound to work) under attachments/<id>, where the id is 256 random bits so the address is its permission, as Docs files' is; a row in the new attachments table (migration 0048) names the repository, and repo.purged deletes the bytes, then the rows. The usercontent origin serves /attachments/<id> as it serves avatars (stored type, nosniff, sandboxed). The API forms url from USERCONTENT_URL as the site does (g1tusercontent.com for g1t.sh, SITE_URL/-/usercontent elsewhere; the self-host config now passes it to the API). The CLI has g1t attach FILE... (prints each image's Markdown; --json the fields, a list for several) and --attach FILE (repeatable) on g1t issue create, issue comment, pr create, pr comment and pr ready, which uploads and appends the Markdown after the text. A session's run credential gets upload_attachment through issues:write, bound to its own repository (tested), and the cloud session's system prompt says to upload screenshots with g1t attach and never commit images just to link them. Docs: the CLI guide (Images in descriptions and comments), pull requests (Images), sessions, the MCP reference, self-hosting's USERCONTENT_URL row, reference.json and the regenerated openapi.json, CLI ops table and CLI reference. Deploy order: apply work migration 0048 and deploy work (new AVATARS binding), then the site (usercontent serves /attachments), then api, then integrations (prompt) and the docs; g1t attach and --attach ship with the next CLI release, which cloud sessions need before the prompt's advice works. Checked: cargo test -p g1t-contracts (319), -p g1t-work (209), -p g1t-api (211; openapi regenerated with G1T_WRITE_OPENAPI), -p g1t (112 + 51; ops_table and cli_reference regenerated with G1T_WRITE_OPS and G1T_WRITE_DOCS), -p g1t-integrations (76); cargo check -p g1t-api, -p g1t-work and -p g1t-integrations --target wasm32-unknown-unknown; node --test apps/web/app/lib/token-scopes.test.ts.2d ago

search.tsg1t is the stored author of what it opens; the person who asked is requested_by and keeps the author's rights1w ago

security-suite.tsMerge commit '9232a85b'2d ago

security.tsSecurity and version updates open no issues on their own: an update whose version cannot be raised fails with why on its alert and is tried again a day later, and one whose required checks fail stays open for a person to decide on; an agent takes one only when a person asks with Fix with g1t. That issue now names the lockfiles the package is locked in and the commands that show it is done, which were left empty ("Locked in: .") because the lockfiles were never passed in.5d ago

sounds.tsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

status.tsMerge status detection: first-byte speed probe, deploy windows, 4 of 5 with a re-check, check history, reminders1w ago

teams.tsThe contracts no longer describe g1t's own agents, and workspaces can keep their AI providers. Every consumer had already stopped using them, so the TypeScript and Rust contracts drop the workspace-agent, ability, look, skill-library, context, runner-agent and mention modules, the chat and docs RPCs agents posted and read through, the folio agent methods, the agent_waiting notification, agent.asked and memory.changed events, AI credit, token and gateway billing types, model routes and sessions, team agents, agent tokens, plan, review, message and confidence types, command rules, cost caps and confidence rules. The agents:run and models:* scopes are no longer offered by any preset, OAuth default or permission form, but a stored token or grant that names them still reads; and the removed operations are gone from the scope table, so the API's check that every operation has exactly one scope is strict again. What stored data needs in order to parse (old run and credential kinds, an agent team lead, retired rules and webhook events, old guardrail and integration settings) still parses, and a run's token is still PrincipalKind::Agent, which now means a run's token and the @g1t rows written before. The customize, marketplace, skills and claude-plugin contracts stay only until the mobile app drops its Customize screens.4d ago

telemetry.tsMerge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them.4d ago

updates.tsTeams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1w ago

webhooks.tsMerge branch 'forking': repository forking, pull request merge methods and every repository setting for pull requests, commits, pushes and issues2d ago

work.tsA session g1t starts on Claude Managed Agents acts as g1t for the person who started it: on flagon-io/demo #1 the session closed the issue and the timeline said "syntaqx closed this as completed", because its token was a plain personal access token for @syntaqx (create_access_token, scoped to the repository), so every comment, close, review and pull request it made read as theirs. It now holds a run credential of a new kind, session (credentials::RunCredentialKind::Session, made by identity's create_run_credential, up to 12 hours, revoked when the session ends as before): it resolves to g1t on behalf of the person, may use every API and MCP operation credentials::SESSION_SCOPES allow (the scopes the old token had) and never one in NEVER, in its repository only, with the person's role there capped at Write, and pushes with git to that repository (any branch, so a new repository's first version still goes to its default branch) and to the working copies of its pull requests (decide_git_at, resolved by repos from the fork's source). Past the API and git it is the person with acting kept (as_person), so the session, its claims, its pull requests' forks and its pushes stay theirs and their role decides, while what it writes is recorded as g1t's for them: issues and pull requests it opens are g1t's, requested by them (work::authorship), and its comments, reviews and the events it notes (close, reopen, labels, assignees, milestones, blocked-by, ready, draft) are written as g1t with acting_for the person (work rows::By, into the acting_for columns of migration 0033), shown as "g1t ... on behalf of @syntaqx" on the issue and pull request pages; the person can still edit them, and a session's approval counts only where agents' approvals do. The system prompt says the token is g1t's for that person. The sessions guide and the identity architecture page say what a session acts as. Deploy order: every Worker that reads a viewer (api, repos, work, packages, events, identity and the rest) before integrations, which is the only one that makes the new kind; no migration. Checked: cargo test -p g1t-contracts (316) -p g1t-work (201) -p g1t-identity (183) -p g1t-integrations (76) -p g1t-repos (363) -p g1t-api (209) -p g1t-packages (112); cargo check --target wasm32-unknown-unknown of g1t-work, g1t-identity, g1t-integrations, g1t-repos, g1t-api, g1t-packages; apps/web tsc -b shows no errors in components/work.tsx (the rest need typegen).2d ago