fix(github): Handle GraphQL egress permissions

[dcramer]

GitHub GraphQL egress now treats read-only query POSTs as installation-read and annotates GraphQL HTTP 200 access errors as permission_denied without rewriting provider responses. This keeps read commands on app installation credentials while preserving provider CLI output and giving Junior structured permission context when GitHub reports access failures in the response body.

Provider Response Hooks

Plugins can inspect response metadata and lazily read a bounded cloned body. Normal hook return preserves the original upstream response; EgressAuthRequired is the only response-hook path that rewrites to Junior's auth-required sentinel.

defineJuniorPlugin({
  hooks: {
    async onEgressResponse(ctx) {
      if (ctx.response.status !== 200) {
        return;
      }

      const body = await ctx.response.readText(64 * 1024);
      if (body?.includes("Resource not accessible by integration")) {
        ctx.permissionDenied("Provider denied access to this resource.");
      }

      // Throw only when the provider response means user auth must be refreshed.
      // throw new EgressAuthRequired("Provider needs reauthorization.");
    },
  },
});

GitHub GraphQL

The GitHub plugin owns all GraphQL response interpretation for POST /graphql, classifying known access-shaped JSON errors such as repository NOT_FOUND and Resource not accessible by integration as side-channel permission signals.

Coverage

Integration coverage now exercises read-query installation tokens, mutation user-write auth, auth-required response-hook interruption, GraphQL access-error pass-through with permission_denied, and successful GraphQL pass-through without a permission signal.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
junior-docs	Ready	Preview, Comment	Jun 8, 2026 12:15pm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e61b5c. Configure here.}