v2.1.1

Fixed

• The container installed its dependencies by resolving pyproject.toml
  fresh instead of from the committed, Dependabot-maintained uv.lock.
  pip install . reads only the floor pins, so the image could ship whatever
  had been released that morning -- a dependency set no test had ever run
  against. That is how google-genai 3.0 reached mcp-gemini's production
  with CI green (RT #1564); this repo had the same gap. The builder now
  installs from a uv export of the lock with --no-deps, so the image
  carries exactly what CI tested.

v2.1.0 — the JSON path gets the ceiling the log download already had

Part of RT #1601's sweep — and the repo that proves the constitution check is a tripwire rather than a proof.

It passed the bounded-read signal, because _download_job_log has always read in bounded pieces. The JSON path that every other tool goes through had a content-length check and nothing else: one of two read paths streamed, so the repo looked done. The check's docstring names this as its second false pass; this is the repo it names.

Fixed

• The JSON path now streams too, measured before each chunk is copied in. aiter_bytes() promises nothing about chunk size — one chunk can be the whole body — so appending first would copy in exactly the response being refused.
• An error that is not GitHub's JSON shape says what it was. It arrived as Unknown error, or 200 bare characters of body with no indication of where they came from, so an Enterprise login page, a proxy error and the API refusing something were one message. Such a body is now quoted, bounded, alongside the method, URL, status and content-type. GitHub's own message is still used verbatim, now length-bounded.
• The URL in an error carries no secret. Userinfo is dropped, and access_token — GitHub's own retired query-string auth — with client_secret, code and token are redacted by name. By name, because per_page, state and sha are the diagnosis.

Added

• The client says what it is. GitHub asks API clients to send a User-Agent, and httpx's default python-httpx/<version> is what bot protection answers with a challenge page (RT #1596).

Changed

• Inherits constitution v1.36.0.

v2.0.1

Security

• Upgraded locked dependencies within their declared ranges to clear the
  advisories the fleet dependency audit found (anyio, authlib, cryptography, dnspython, joserfc, opentelemetry-api, pydantic-settings, pyjwt).

v2.0.0

Changed

• Breaking: get_failed_job_logs_tool no longer returns the raw log tail
  (log/log_lines) by default. Each failed job now carries a
  failure_summary instead — the tail lines that name the cause (error
  annotations, test failures, tracebacks, non-zero exits), with
  summary_lines. A failed job's log can run to the byte cap and, for a
  repository whose CI quotes attack corpora (e.g. a prompt-injection defense
  project), a scanning gateway may flag and withhold the whole tail, leaving
  the operator unable to see why CI failed. The distilled summary is small and
  signal-only, so it is far more likely to pass such a gateway. Pass
  include_raw_log=true to also get the full cleaned tail as log/log_lines,
  exactly as before (that path is what a gateway may still withhold). The
  summary counts against the same 256 KiB result budget as the raw tail.

Added

• get_failed_job_logs_tool gains an include_raw_log parameter (default
  false).

v1.6.0

Changed

• Container base images pinned to quay.io/hummingbird/python:3.14* instead of
  latest, which moved to Python 3.15.0 on 2026-10-20 (crunchtools/constitution#66).

v1.5.0

Added

• merge_pull_request_tool and get_pull_request_checks_tool work with a
  fine-grained token. GitHub cannot grant one the Checks permission, so
  check-runs answers 403; the tools then read the head commit's Actions jobs
  (Actions: read), each of which is a check run with the same id and name.
  Only Actions-reported checks are visible that way, so the merge gate
  refuses a required check that names another app, or that accepts any app
  and has no commit status. Both results carry checks_source.

Fixed

• get_pull_request_checks_tool reads every page of check runs, not just the
  first, up to the merge gate's page limit; past it the verdict says
  truncated and is not ready_to_merge.

v1.4.0

Added

• list_issue_comments_tool: the comments on an issue or a pull request
  conversation, oldest first, one page at a time, with id, author,
  author_association, created_at, updated_at, body and html_url (#45).

Fixed

• list_pull_request_comments_tool called on a plain issue returned GitHub's
  403 "Resource not accessible by personal access token", which reads like a
  token scope problem. It now says the number is an issue and points to
  list_issue_comments_tool (#45).

v1.3.2

Fixed

• The integer ID parameters of the read tools (issue_number, pull_number,
  run_id) now publish minimum: 1 in their schema, so 0 and negative IDs
  are rejected.

v1.3.1: Merge pull request #42 from crunchtools/fix/rate-limit-reset-duration

Fixed

• A primary rate limit reported GitHub's x-ratelimit-reset epoch as the wait ("Retry after 1792152901 seconds"). It now reports the seconds left until the reset.

v1.3.0

Added

• GITHUB_ACCEPT_REQUEST_TOKEN (default off): over HTTP, act with the token
  in each request's Authorization: Bearer <token> header, the way GitHub's
  hosted MCP server takes it, falling back to GITHUB_TOKEN. With it on,
  GITHUB_TOKEN is optional. A malformed header is refused, never
  forwarded; a call with no token at all fails before reaching GitHub.
  stdio is unchanged.
• merge_pull_request_tool takes allow_no_required_checks (default
  False).

Changed

• merge_pull_request_tool enforces the base branch's required status
  checks itself before merging: from rulesets and classic branch
  protection, every required check must have a passing check run (success,
  skipped or neutral) or a successful status on the head commit, or the
  merge is refused with each offending check named. A branch with no
  required checks is refused unless allow_no_required_checks=True, and a
  branch protection that cannot be read is refused. Classic protection is
  read from the branch itself, so no Administration permission is needed.
  The merge is always pinned to the checked head SHA. It now needs Pull
  requests: read and Commit statuses: read as well as Contents: write.

Security

• An organization owner's token can bypass required checks on GitHub's
  side; the merge gate closes that for this tool.
• The request token is scrubbed from error messages like GITHUB_TOKEN,
  and is passed per call, never stored on the shared HTTP client.