feat(discord): git verbs for the Discord Sage on the shared-signals root, seat identity through a package credential helper, vault record protocol (#1509)

Row 24. A writable root that is a git work tree may carry a git object in
the binding; the seat then has git_status, git_commit (explicit paths, seat
author, Requested-by trailer from the envelope requester, push at once per
D6), git_pull (ff-only) and git_push (one branch, never force), plus
reserve_id and per-write clone locks under protocol vault. Git children run
with no host config and one credential helper, bin/git-credential.mjs,
reading the 0600 seat token file named in the binding; the fleet helper
serves only the Gitea hosts. Suite 58/58, node 143. rev-code-02 APPROVED
round 1 (#1509 comment 26375, tree 82ab962f).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

packages/discord/extension/tools.mjs

@@ -16,6 +16,7 @@
 
 import { Type } from "typebox";
 import { TOOLS_ENV, TOOL_DESCRIPTIONS, READ_MAX_LINES, loadToolsConfig, createToolSet, enabledToolNames } from "../src/tools.mjs";
+import { COMMIT_MESSAGE_MAX, COMMIT_PATHS_MAX, VAULT_PREFIXES } from "../src/git.mjs";
 
 const PARAMS = {
   list_dir: () => Type.Object({
@@ -50,8 +51,37 @@ const PARAMS = {
   web_search: () => Type.Object({
     query: Type.String({ description: "Search words, as you would type them" }),
   }),
+  git_status: () => Type.Object({
+    root: Type.String({ description: "Name of a root that has git" }),
+  }),
+  git_commit: () => Type.Object({
+    root: Type.String({ description: "Name of a root that has git" }),
+    message: Type.String({ description: `Commit message, one to ${COMMIT_MESSAGE_MAX} characters: what changed and why` }),
+    paths: Type.Array(Type.String({ description: "File path relative to the root" }), { description: `The files to commit, relative to the root; at most ${COMMIT_PATHS_MAX}`, minItems: 1, maxItems: COMMIT_PATHS_MAX }),
+  }),
+  git_pull: () => Type.Object({
+    root: Type.String({ description: "Name of a root that has git" }),
+  }),
+  git_push: () => Type.Object({
+    root: Type.String({ description: "Name of a root that has git" }),
+  }),
+  reserve_id: () => Type.Object({
+    root: Type.String({ description: "Name of a root that follows the record protocol" }),
+    prefix: Type.Union(VAULT_PREFIXES.map((p) => Type.Literal(p)), { description: `Record prefix: ${VAULT_PREFIXES.join(", ")}` }),
+    title: Type.String({ description: "What the record will be about, one line" }),
+  }),
 };
 
+// The envelope's first line names the requester by the name the binding
+// gives that Discord user; the connector writes it, the user cannot. A
+// prompt that does not start with an envelope leaves the requester unset,
+// and git_commit then refuses.
+const ENVELOPE_REQUESTER = /^\[discord [^\n]*? requester="([^"\n\]]{1,100})"[^\n]*\]\n/;
+export function requesterOf(prompt) {
+  const m = typeof prompt === "string" ? prompt.match(ENVELOPE_REQUESTER) : null;
+  return m ? m[1] : null;
+}
+
 export default function (pi) {
   const raw = process.env[TOOLS_ENV];
   if (typeof raw !== "string" || raw.length === 0) throw new Error(`${TOOLS_ENV} is not set; the connector sets it from the binding's tools key`);
@@ -63,18 +93,23 @@ export default function (pi) {
   }
   const config = loadToolsConfig(parsed);
   const tools = createToolSet(config);
-  const rootNames = config.roots.map((r) => (r.write ? `${r.name} (writable)` : r.name)).join(", ");
+  const rootNames = config.roots.map((r) => (r.git ? `${r.name} (writable, git on ${r.git.branch})` : r.write ? `${r.name} (writable)` : r.name)).join(", ");
+  const gitRoots = config.roots.filter((r) => r.git).map((r) => r.name).join(", ");
 
+  pi.on("before_agent_start", async (event) => {
+    tools.setRequester(requesterOf(event.prompt));
+  });
   pi.on("agent_start", async () => {
     tools.resetBudget();
   });
 
   for (const name of enabledToolNames(config)) {
     const d = TOOL_DESCRIPTIONS[name];
+    const suffix = name.startsWith("web_") ? "" : name.startsWith("git_") || name === "reserve_id" ? ` Roots with git: ${gitRoots}.` : ` Declared roots: ${rootNames}.`;
     pi.registerTool({
       name,
       label: d.label,
-      description: name.startsWith("web_") ? d.description : `${d.description} Declared roots: ${rootNames}.`,
+      description: `${d.description}${suffix}`,
       promptSnippet: d.snippet,
       parameters: PARAMS[name](),
       async execute(_toolCallId, params) {