[Feat] Enable native GitHub PR updates, comments, and reactions in Fast (#2367)

* feat: enable bounded GitHub writes through existing MCP proxy

* fix: keep bounded source inspection in Fast

* fix: preserve native GitHub MCP write contracts

* fix: omit caller-controlled keys from GitHub audit logs

* refactor: simplify bounded GitHub write enforcement

---------

Co-authored-by: @daniel-lxs <57051444+daniel-lxs@users.noreply.github.com>

Author: roomote-roomote[bot]

apps/api/src/handlers/mcp/__tests__/github.test.ts

@@ -1,27 +1,50 @@
 import {
+  getAllowedRouterMcpToolNames,
   getRouterMcpUpstreamConstraints,
   type RouterMcpServerId,
 } from '@roomote/cloud-agents/router-mcp-policy';
-import { createGitHubToken } from '@roomote/auth';
+import {
+  createGitHubToken,
+  resolveRuntimeGitHubAppCredentials,
+} from '@roomote/auth';
+import { and, db, eq, isNull, repositories, users } from '@roomote/db/server';
 import { Env } from '@roomote/env';
+import { z } from 'zod';
 
-import { createMcpProxy, McpProxyError } from './proxy-utils';
+import {
+  createMcpProxy,
+  McpProxyError,
+  resolveActingUserId,
+} from './proxy-utils';
 
 const DEFAULT_GITHUB_MCP_URL = 'https://api.githubcopilot.com/mcp/';
 const ROUTER_GITHUB_SERVER_ID: RouterMcpServerId = 'github';
 
+const repositoryArgs = z.object({
+  owner: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9-]*$/),
+  repo: z
+    .string()
+    .regex(/^[a-zA-Z0-9_.-]+$/)
+    .refine((value) => value !== '.' && value !== '..'),
+});
+const writeToolNames = [
+  'update_pull_request',
+  'add_issue_comment',
+  'add_reply_to_pull_request_comment',
+];
+
 function isMissingGitHubInstallationError(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error);
   return message.toLowerCase().includes('installation not found');
 }
 
-function buildRouterGitHubHeaders(): Record<string, string> {
+function buildRouterGitHubHeaders(readonly: boolean): Record<string, string> {
   const constraints = getRouterMcpUpstreamConstraints(ROUTER_GITHUB_SERVER_ID);
   const headers: Record<string, string> = {};
 
-  if (constraints?.readonly) {
-    headers['X-MCP-Readonly'] = 'true';
-  }
+  headers['X-MCP-Readonly'] = String(
+    readonly || constraints?.readonly === true,
+  );
 
   if (constraints?.toolsets?.length) {
     headers['X-MCP-Toolsets'] = constraints.toolsets.join(',');
@@ -34,12 +57,122 @@ export function createGithubMcp(options?: {
   allowAuthTokens?: boolean;
   allowedToolNames?: readonly string[];
 }) {
+  const allowedToolNames = getAllowedRouterMcpToolNames('github').filter(
+    (name) =>
+      !options?.allowedToolNames || options.allowedToolNames.includes(name),
+  );
   return createMcpProxy({
     name: 'GitHub',
     upstream: Env.GITHUB_MCP_SERVER_URL ?? DEFAULT_GITHUB_MCP_URL,
     allowAuthTokens: options?.allowAuthTokens,
-    allowedToolNames: options?.allowedToolNames,
-    resolveCredentials: async () => {
+    allowedToolNames,
+    resolveCredentials: async (auth, _params, request) => {
+      if (Array.isArray(request))
+        throw new McpProxyError(
+          400,
+          'GitHub MCP batch requests are not allowed',
+        );
+      const rpc = request as
+        | { method?: string; params?: { name?: string; arguments?: unknown } }
+        | undefined;
+      const name = rpc?.method === 'tools/call' ? rpc.params?.name : undefined;
+      if (
+        rpc?.method === 'tools/call' &&
+        (typeof name !== 'string' || !allowedToolNames.includes(name))
+      ) {
+        throw new McpProxyError(
+          403,
+          'GitHub MCP tool is not allowed on this endpoint',
+        );
+      }
+      if (name && writeToolNames.includes(name)) {
+        // Fast uses user tokens. Keep run tokens read-only here rather than
+        // creating a second write path around coding-task repository scope.
+        if (auth.tokenType !== 'auth') {
+          throw new McpProxyError(
+            403,
+            'GitHub MCP writes require a user-scoped auth token',
+          );
+        }
+        const parsed = repositoryArgs.safeParse(rpc?.params?.arguments);
+        if (!parsed.success)
+          throw new McpProxyError(
+            400,
+            'Invalid GitHub write repository arguments',
+          );
+        const args = parsed.data;
+        const userId = await resolveActingUserId(auth);
+        const actor = await db.query.users.findFirst({
+          where: and(eq(users.id, userId), isNull(users.deletedAt)),
+          columns: { id: true },
+        });
+        if (!actor)
+          throw new McpProxyError(
+            403,
+            'GitHub writes require an active Roomote member',
+          );
+        // Repository access is deployment-scoped, matching the existing repository
+        // helpers. Do not mistake a stored installation owner for a per-user ACL.
+        const repository = await db.query.repositories.findFirst({
+          where: and(
+            eq(repositories.sourceControlProvider, 'github'),
+            eq(repositories.fullName, `${args.owner}/${args.repo}`),
+            eq(repositories.isActive, true),
+          ),
+          with: { githubInstallation: true },
+        });
+        const installation = repository?.githubInstallation;
+        if (
+          !repository ||
+          !installation ||
+          installation.suspendedAt ||
+          !repository.githubRepoId ||
+          (repository.host && repository.host !== 'github.com')
+        ) {
+          throw new McpProxyError(
+            403,
+            'GitHub write target must be an active connected repository',
+          );
+        }
+        const appCredentials = await resolveRuntimeGitHubAppCredentials();
+        if (String(installation.appId) !== appCredentials.appId)
+          throw new McpProxyError(
+            403,
+            'GitHub repository installation does not belong to the configured app',
+          );
+        const token = await createGitHubToken(
+          {
+            type: 'installationId',
+            installationId: installation.id,
+            repositoryIds: [repository.githubRepoId],
+          },
+          appCredentials,
+        );
+        const originalArgs = rpc?.params?.arguments as Record<string, unknown>;
+        const targetNumber =
+          originalArgs.pullNumber ?? originalArgs.issue_number;
+        console.info(
+          JSON.stringify({
+            event: 'github_mcp_write_authorized',
+            userId,
+            runId: auth.runId,
+            tool: name,
+            repositoryId: repository.id,
+            repositoryFullName: repository.fullName,
+            installationId: installation.installationId,
+            targetNumber:
+              typeof targetNumber === 'number' ? targetNumber : undefined,
+            commentId:
+              typeof originalArgs.commentId === 'number'
+                ? originalArgs.commentId
+                : undefined,
+          }),
+        );
+        return {
+          authHeader: token,
+          extraHeaders: buildRouterGitHubHeaders(false),
+        };
+      }
       let githubToken: string;
       try {
         githubToken = await createGitHubToken({ type: 'activeInstallation' });
@@ -55,7 +188,11 @@ export function createGithubMcp(options?: {
 
       return {
         authHeader: githubToken,
-        extraHeaders: buildRouterGitHubHeaders(),
+        disabledToolNames:
+          auth.tokenType === 'run' ? writeToolNames : undefined,
+        extraHeaders: buildRouterGitHubHeaders(
+          auth.tokenType === 'run' || rpc?.method !== 'tools/list',
+        ),
       };
     },
   });

apps/api/src/handlers/mcp/github.ts

@@ -367,6 +367,7 @@ interface McpProxyConfig {
   resolveCredentials: (
     auth: McpAuthContext,
     routeParams: Record<string, string>,
+    request: unknown,
   ) => Promise<ResolvedCredentials>;
   allowAuthTokens?: boolean;
   validateTaskRunToken?: (auth: RunTokenContext) => Promise<Response | null>;
@@ -911,7 +912,7 @@ export function createMcpProxy(config: McpProxyConfig) {
     let credentials: ResolvedCredentials;
 
     try {
-      credentials = await resolveCredentials(auth, c.req.param());
+      credentials = await resolveCredentials(auth, c.req.param(), parsedBody);
     } catch (error) {
       console.warn(
         formatSingleLineLog(`${logPrefix} Failed to resolve credentials`, {

apps/api/src/handlers/mcp/proxy-utils.ts

@@ -43,6 +43,26 @@ dashboard page.
 You do not need to choose a separate conversation mode. The Session grows from
 conversation to execution to review without changing identity.
 
+## Source-control work without a workspace
+
+Fast uses existing integration APIs for bounded repository inspection when the
+available tools can answer the question. Reading files, searching a repository,
+or inspecting commits, pull requests, and reported CI results does not require
+cloning a repository or provisioning a workspace. Available reads depend on the
+connected integration's tools and permissions. Reading CI results is not the
+same as running tests: local checkout, code edits, command execution, and testing
+are delegated to a task, as are investigations that need a workspace.
+
+The existing [GitHub integration](/providers/source-control/github#daily-github-management)
+also supports updates to existing pull requests, issue or PR comments,
+review-comment replies, and reactions using the deployment's GitHub App.
+See that guide for supported actions and access requirements.
+
+[GitLab MCP](https://docs.gitlab.com/user/model_context_protocol/mcp_server/)
+and [Bitbucket Cloud MCP](https://support.atlassian.com/atlassian-ai-gateway/docs/supported-tools/#Bitbucket-Cloud-tools)
+are not enabled for this direct Fast path. Their compatibility with Roomote's
+existing credentials has not been verified; existing task workflows are unchanged.
+
 ## The session view
 
 A Session header shows the other people currently viewing that Session. Your

apps/docs/fast-sessions.mdx

@@ -190,6 +190,35 @@ items.
 
 ## Daily GitHub management
 
+Fast can use the native `update_pull_request`, `add_issue_comment`, and
+`add_reply_to_pull_request_comment` tools without starting a coding task.
+Their discovered descriptions and schemas define the supported arguments,
+including reviewer requests, draft status, base retargeting, maintainer edit
+permission, comments, replies, and reactions. These actions use the deployment
+GitHub App, require an active Roomote member and an active connected repository,
+and remain subject to the installation's issue or pull request write permission.
+No personal GitHub OAuth connection is required. Ask for the specific change and
+identify the repository and target issue, pull request, or comment. Authorization
+is repository-scoped, not restricted to pull requests. A reaction-only call on an
+existing review comment can use `commentId` without `pullNumber` when allowed by
+the discovered native schema.
+
+For example, ask Roomote to:
+
+- mark PR #42 in `example/repo` ready for review
+- request a review from `octocat` on that PR
+- add a thumbs-up reaction to an existing comment, providing its GitHub URL
+
+Retargeting a pull request's base to an existing branch does not write a branch
+or change files. Merging, creating or deleting pull requests, writing branches
+or files, editing or deleting comments, and repository administration are
+not available through this bounded Fast path; those requests still require a
+coding task. Other source-control providers are unchanged.
+
+Native updates that combine several actions are not guaranteed to be atomic.
+After an error, Roomote inspects the resulting state before retrying so an action
+that already succeeded is not blindly repeated.
+
 Roomote tasks can manage routine repository work through the GitHub App
 installation. Requests default to the repository mapped to the task:
 

apps/docs/providers/source-control/github.mdx

@@ -44,6 +44,7 @@ export {
   createGitHubToken,
   createGitHubTokenWithMetadata,
   resolveGitHubAppCredentials,
+  resolveRuntimeGitHubAppCredentials,
 } from './github-token';
 
 export {