Repository navigation
Tools: run_code sandbox, GitHub and Linear built in - #13
Merged
Merged
Conversation
…d data work The agent runs code in QuickJS compiled to WebAssembly, on a worker thread, with a fresh runtime per call: no network, disk, timers or host objects; 5 s, 64 MB, stack and output limits. Attached text, CSV, JSON and PDF files are exposed as `files` with a csv() helper, and saveFile() stores a private result file whose id comes back. A read whose output counts as untrusted. The task view shows the result, printed output and saved files.
…eate, update and comment with approval Linear OAuth 2 with PKCE and rotating refresh tokens, sealed in the integrations table; a revoked grant flips to needs_auth and withholds the tools. Seven tools over GraphQL with injectable fetch; team and issue fields count as destinations for the read-never-widens- the-write check. Connections card, approval views for new issues and comments, risk facts, a fake Linear for tests, docs/linear.md.
…file issues as you - Connect from Connections with the GitHub OAuth app (sign-in app or GITHUB_TOOLS_* override), scopes repo and read:org, PKCE, token sealed in integrations; disconnect revokes at GitHub - Tools: github_search, github_read (PR files, reviews, checks), github_my_work, github_read_file, github_comment (send), github_create_issue, github_update_issue (write) - 401 marks the connection needs_auth; rate limits report the reset time; 404 says not found or no access - Risk facts for GitHub writes, repo destination test, approval views for comments and issues - Fake GitHub, unit and end-to-end tests; docs/github.md, API docs, README
# Conflicts: # README.md # apps/server/src/app.ts # apps/server/src/config.ts # apps/server/src/routes/integrations.ts # apps/server/src/services.ts # apps/server/src/worker.ts # apps/web/app/(app)/connections/page.tsx # apps/web/components/approval/payload.tsx # apps/web/lib/api.ts # docs/api.md # packages/core/src/risk.test.ts # packages/core/src/risk.ts # packages/db/src/schema.ts # packages/tools/package.json # packages/tools/src/index.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three more tool groups, all on the existing approval and policy rules.
run_code: exact arithmetic and data work
quickjs-emscripten@0.32.0, pinned), inside a Bun Worker so a long loop can't block the server.files: the text of the user's own attached files.csv(): a CSV parser.saveFile(): saves results as files you can email.read. A call that reads files taints the run, because file content can steer what happens next. A pure calculation does not. Core now has an optional per-calltaints(input)onToolDefinitionto support this. Addresses in the output still never count as recipients the user named.GitHub, built in
repoandread:org. It reusesGITHUB_CLIENT_ID/SECRETby default, or a separateGITHUB_TOOLS_*app. Disconnecting revokes the token; with a dedicated app it revokes the whole grant.github_searchgithub_read: an issue or PR, with files, reviews, checks and comments.github_my_work: review requests, assigned items and your open PRs.github_read_filegithub_comment,github_create_issue,github_update_issue.Linear, built in
read,write. Access tokens last 24 h and the refresh token rotates on each use. A revoked grant setsneeds_auth. Disconnecting revokes both tokens.linear_search,linear_read,linear_my_issues, andlinear_list_teams(trusted ids and names).linear_create_issue,linear_update_issue(adds or removes labels, never replaces the whole set),linear_comment.teamandissuecount as targets, so a team only seen in something the agent read is flagged.Checks
docs/github.mdanddocs/linear.md.