{"_id":"@amitkot/pi-safe-github","_rev":"2-67bc76c46bee93b72c51135f4b46d192","name":"@amitkot/pi-safe-github","dist-tags":{"latest":"0.2.0"},"versions":{"0.1.0":{"name":"@amitkot/pi-safe-github","version":"0.1.0","keywords":["pi-package","pi-extension","github","gh"],"license":"MIT","_id":"@amitkot/pi-safe-github@0.1.0","maintainers":[{"name":"amitkot","email":"amit@amitkot.com"}],"pi":{"extensions":["./src/index.ts"]},"dist":{"shasum":"51ff49288167d772d961f275657428098a7519c3","tarball":"https://registry.npmjs.org/@amitkot/pi-safe-github/-/pi-safe-github-0.1.0.tgz","fileCount":3,"integrity":"sha512-MaPVysupgRK2GkZDV0vIZ2AGzXFzA7T8J7nIXutn7gfjvZtyrUgkSnpUpJXac7zwSkT9+uV5aijGKVwA3luSyQ==","signatures":[{"sig":"MEUCIQCiy8pcjzHOmhztUk3mj+7Q8+UrAe2g8z6F0rrCDEVqVwIgIXgb2XgI6afzImJYzNjYxWRLm8niZMNqQTEA9x2dvpc=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":26007},"type":"module","gitHead":"2ed31b29fa5747c1006d463e518a99baf5870b7b","scripts":{"test":"node ../../tests/safe-github.test.mjs","check":"node ../../scripts/check.mjs"},"_npmUser":{"name":"amitkot","email":"amit@amitkot.com"},"_npmVersion":"10.9.8","description":"A narrow host-side GitHub bridge extension for Pi.","directories":{},"_nodeVersion":"22.22.3","_hasShrinkwrap":false,"peerDependencies":{"typebox":"*"},"peerDependenciesMeta":{"typebox":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/pi-safe-github_0.1.0_1781469252094_0.3983403282629794","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@amitkot/pi-safe-github","version":"0.2.0","type":"module","description":"Typed GitHub wrapper tools for Pi: PRs, CI runs, issues, releases, and workflows.","keywords":["pi-package","pi-extension","github","gh"],"repository":{"type":"git","url":"git+https://github.com/amitkot/pi-tools.git","directory":"packages/safe-github"},"bugs":{"url":"https://github.com/amitkot/pi-tools/issues"},"homepage":"https://github.com/amitkot/pi-tools/tree/main/packages/safe-github#readme","engines":{"node":">=22"},"publishConfig":{"access":"public"},"scripts":{"check":"node ../../scripts/check.mjs","test":"node ../../tests/safe-github.test.mjs"},"pi":{"extensions":["./src/index.ts"]},"peerDependencies":{"typebox":"*"},"peerDependenciesMeta":{"typebox":{"optional":true}},"license":"MIT","_id":"@amitkot/pi-safe-github@0.2.0","gitHead":"fcdc66daf2b9fc9d73a84d2520fbbcfe1071421a","_nodeVersion":"22.22.3","_npmVersion":"10.9.8","dist":{"integrity":"sha512-AP8ukGWeTHnO/rGYKk54+nnXjv9pSQQs7eWpClbIBs6RevREwqlcaBc3OKvgq2DgCbea8eALnJlsgD3p67O6tw==","shasum":"ff89fb6297c3a7cf16c90c2a1ff74dfe611c523d","tarball":"https://registry.npmjs.org/@amitkot/pi-safe-github/-/pi-safe-github-0.2.0.tgz","fileCount":3,"unpackedSize":79197,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIF8NcWtjoKcPxsdE4zv2kQ/Bro/lpC6aB1FQZge9LBUjAiB/FPNSxnZvydTNx/gLt0hZLwPp4DT64POhr1vQvjE3ig=="}]},"_npmUser":{"name":"amitkot","email":"amit@amitkot.com"},"directories":{},"maintainers":[{"name":"amitkot","email":"amit@amitkot.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/pi-safe-github_0.2.0_1781698840978_0.15059089480601595"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-14T20:34:11.892Z","modified":"2026-06-17T12:20:41.230Z","0.1.0":"2026-06-14T20:34:12.221Z","0.2.0":"2026-06-17T12:20:41.127Z"},"license":"MIT","keywords":["pi-package","pi-extension","github","gh"],"description":"Typed GitHub wrapper tools for Pi: PRs, CI runs, issues, releases, and workflows.","maintainers":[{"name":"amitkot","email":"amit@amitkot.com"}],"readme":"# safe-github extension\n\nA narrow, typed GitHub operation surface for Pi.\n\n## Purpose\n\nProvides safe, host-side GitHub operations via the `gh` CLI, bypassing macOS sandbox TLS issues in the sandboxed bash tool.\n\n## Threat Model\n\n- **Risk**: accidental mutation, operations on the wrong repo, shell injection, token exposure.\n- **Mitigations**:\n  - Uses `child_process.execFile` with argument arrays; no shell strings.\n  - Adds execution timeouts and output limits.\n  - Validates and normalizes parameters.\n  - Infers owner/repo from the active Pi session cwd unless `cwd` is provided.\n  - High-risk mutations preview unless `confirm: true`.\n  - Mutation previews redact long bodies/notes.\n  - Does not expose `gh auth token` or a generic `gh` / `gh api` tool.\n  - Does not pass the full process environment to subprocesses.\n\n## Installation\n\n```bash\npi install npm:@amitkot/pi-safe-github\n```\n\nFor local development from a checkout:\n\n```bash\npi -e ./packages/safe-github/src/index.ts\n```\n\nIf you are working inside this repository, Pi can also auto-load the project-local shim at `.pi/extensions/safe-github/index.ts` after the project is trusted.\n\n## Requirements\n\n- GitHub CLI (`gh`) installed on the host machine\n- Host `gh` authenticated (`gh auth status`)\n- Run Pi from inside a GitHub-backed git repository for repo/PR tools\n\n## Tools\n\n### Read-oriented\n\n- `github_auth_status` — verify gh CLI auth and logged-in user\n- `github_repo_info` — repo identity, branches, visibility, viewer permission\n- `github_branch_info` — branch existence, protection, ahead/behind\n- `github_pr_list` — list PRs with filters\n- `github_pr_view` — view a PR or current-branch PR\n- `github_pr_checks` — detailed PR checks with links\n- `github_pr_files` — changed files for a PR\n- `github_pr_diff` — truncated PR diff/patch\n- `github_run_list` — list workflow runs\n- `github_run_view` — view run jobs and failed steps\n- `github_commit_status` — commit status and check runs for SHA/HEAD\n- `github_issue_list` — list issues\n- `github_issue_view` — view issue\n- `github_workflow_list` — list workflows\n- `github_workflow_view` — view workflow summary/YAML\n- `github_release_list` — list releases\n- `github_release_view` — view release details/assets\n\n### Sensitive read\n\n- `github_run_logs` — fetch/tail workflow logs. Recommended permission: `ask`.\n\n### Mutating\n\n- `github_pr_create` — preview/create PR\n- `github_pr_edit` — edit PR title/body\n- `github_pr_comment` — comment on PR\n- `github_pr_review` — approve/comment/request changes\n- `github_pr_ready` — mark draft PR ready\n- `github_pr_close` / `github_pr_reopen`\n- `github_pr_merge` — preview/merge with safeguards\n- `github_issue_create`\n- `github_issue_comment`\n- `github_issue_edit`\n- `github_issue_close` / `github_issue_reopen`\n- `github_workflow_dispatch` — preview/dispatch workflow\n- `github_run_rerun` — preview/rerun workflow run/job\n- `github_run_cancel` — preview/cancel workflow run\n- `github_release_create` — preview/create release\n- `github_release_upload_asset` — preview/upload one release asset\n\n## Approval Model\n\nConfigure mutating tool names as `ask` in `@gotgenes/pi-permission-system`.\n\nHigh-risk tools also require `confirm: true` internally:\n\n- `github_pr_create`\n- `github_pr_merge`\n- `github_workflow_dispatch`\n- `github_run_rerun`\n- `github_run_cancel`\n- `github_release_create`\n- `github_release_upload_asset`\n\nCalling these without `confirm: true` returns a preview only.\n\nRecommended permission examples are in `docs/plans/safe-github-expanded-tools.md`.\n\n## Prompt Guidelines\n\n- Use these typed tools instead of raw `gh` commands.\n- Use `github_auth_status` before GitHub operations when auth is uncertain.\n- Use `github_repo_info` before mutating operations to confirm the repo/branch.\n- Never use raw `gh api`, `gh auth token`, or shell for GitHub operations when these tools are available.\n\n## Testing\n\n```bash\nnpm run check\nnpm test\n```\n\nManual smoke tests after `/reload`:\n\n1. Call `github_auth_status`.\n2. Call `github_repo_info`.\n3. Call `github_pr_list` / `github_pr_view`.\n4. Use `github_pr_checks`, `github_run_list`, and `github_run_view` on a repo with Actions.\n5. Call a high-risk mutation without `confirm`; expected: preview only.\n6. Call the same mutation with `confirm: true` only in a test repo/branch and approve the Pi permission prompt.\n","readmeFilename":"README.md","homepage":"https://github.com/amitkot/pi-tools/tree/main/packages/safe-github#readme","repository":{"type":"git","url":"git+https://github.com/amitkot/pi-tools.git","directory":"packages/safe-github"},"bugs":{"url":"https://github.com/amitkot/pi-tools/issues"}}