Gluecron

Grab an exclusive lease on a PR, issue, branch or file path in a repository you can write, for one of your agent sessions. Pass owner+repo with a bare key (PR/issue number, branch name, path), or target_id '<repository id>:<key>'. Returns lease null when another agent holds an active lease.

Return AI spend rollups. Scope by one of: user_id (self), repo {owner,repo}, or agent_session_id. Defaults to caller's user spend.

Commit a patch to a branch without sending whole files — the way to change a few lines of a large file. `patch` is a unified diff as `git diff` prints it (one commit, `message` required) OR `git format-patch` mbox output (each patch becomes its own commit with the patch's own message and author, like `git am`; `message` is ignored). Applied server-side with `git apply --cached` against the branch head (created from `base_branch` if missing); blank context lines a transport stripped to empty lines, or trimmed off the end of the patch, are restored first (git still checks them against the file). `expected_head_sha` makes it compare-and-swap (all zeros = branch must not exist yet). Meets the same branch protection, rulesets and secret scan as a git push, and fires CI/webhooks like one. Patch limit 2 MiB. Requires 'repo' scope. Returns {branch, commit_sha, parent_sha, files_changed, files, commits, created} (+ blank_context_lines_restored / trimmed_blank_context_lines_restored when a repair was needed).

Approve a pull request: records an 'approved' review by the caller — the same review the web form and POST /api/v2/repos/:owner/:repo/pulls/:number/reviews write, so it counts toward branch protection's required approvals and clears the caller's own earlier request for changes. The PR must be open; its author cannot approve it. Requires write access and 'repo' scope. To request changes use merjax_request_changes. Returns {reviewId, number, state, url}.

Assign (or, with remove: true, unassign) users on an issue or pull request. Real assignees since 2026-10-12 — up to 10 per thread, only users who can read the repository; the old `assignee:<username>` labels were migrated. Pass `assignee` (one username) or `assignees` (array). `type` is 'issue' (default) or 'pull_request'. Requires 'repo' scope and write access. Returns {assigned, skipped:[{username, reason}], removed, assignees}.

Apply a set of file writes + deletes as a single atomic commit on a branch (creates the branch if it doesn't exist). The killer agent tool: blob/tree/commit/ref-update sequence. Each change is `{path, content?, content_base64?, deleted?}`. Meets the same branch protection, rulesets and secret scan as a git push, and fires CI/webhooks like one. Requires 'repo' scope.

Site admins only (needs an 'admin'-scoped token). Backup and restore-drill health: whether the newest backup set is verified on an offsite target and how old it is, whether offsite copies are immutable (Object Lock), when a restore drill last passed, whether the backup worker is running, plus targets (host/bucket, never keys), schedule and recent runs. A stale, failed, local-only or never-drilled backup reads RED. Pass start: 'backup' or 'drill' to queue one for the worker (picked up within 15 minutes; audit-logged). Returns {health, reasons, targets, problems, schedule, runs, started?}.

Cancel a queued/running workflow run. Requires 'repo' scope.

Send another message to an existing repo chat. Returns the assistant's reply. If the AI service does not answer this fails with a JSON-RPC error carrying {chat_id, ai_error} rather than returning apology copy as a reply.

Start a new chat with a repo: creates a chat row, sends the first user message, streams + persists the assistant reply. Returns {chat_id, reply}. If the AI service does not answer this fails with a JSON-RPC error carrying {chat_id, ai_error} — it never returns apology copy as a reply. Requires authentication.

Where CI runs and why: mode (external | in-process), declaration (external | in-process | auto) and its source (CI_EXECUTOR on the box, the estate-wide setting, or auto), runners configured / reachable / busy / slots, lastSeenAt, state (ok | degraded | unconfigured | in-process) and holdReason — the sentence every queued run shows when no runner can take it. In-process never runs while external runners are configured. Site admins (admin scope) also get per-runner rows and may pass `declare` (external | in-process | auto) to set the estate-wide setting, audited (the answer then carries `saved`). Same as GET/PUT /api/v2/ci/executor and /admin/runners.

CI health, the same as GET /api/v2/ci/health and /admin/ci: status, the paging rules (queue p95, runner silent, timeout rate, heavy on the app box, runner_slow: a runner over 2x slower than its pool's fastest on the same heavy jobs), queue wait p50/p95 by work class, outcome rates, capacity, runnerSpeed24h (each runner's slowdown against its pool), and `measures`: capacity:compute_trigger (Tallrig ESTATE_PLAN §5's compute row: p95 push-to-start over 5 min for 7 days, or busy slots over 70% for 7 days) with firing, value, window, source and each day. Site admins (admin scope) also get `dashboard` (CAP-0.4) for 24 h and 7 d: startTimes (queue → start p50/p95 by class and pool), duplicateMinutes (lease time on a tree, workflow and job that already had a green job), poolCost (minutes per pool; a cost only where CI_POOL_COST_PER_MINUTE sets one, else 'cost not configured'), notMerged (merge-train dequeue and auto-merge reasons, counted), nonBillable (platform repositories on our machines vs customers'), testSelection (CAP-1.4: minutes saved by test selection and reuse, against full-run medians). Every number carries `source`: the table or setting it was read from. Read-only.

How full the shared CI queue is, and what to do about it: level (ok / busy / saturated), runs queued and running, runner slots, estimated minutes before a new run starts, and — with owner+repo — that repository's queued/running runs, its share of CI work, the slots it may hold while others wait (per work class, and across classes), a recommendation (e.g. batch changes into fewer pushes), and `explanation`: each work class's queued/running runs (interactive, review, push, schedule) and, for each of the repository's queued runs, its class and why it waits (code + sentence, from the claim plan itself). The same `ciQueue` block the write tools return. Ask before a burst of pushes. Also `executor`: where CI runs (external runners or in-process), runners configured / reachable / busy, and `holdReason` when no runner can take a run. Read-only.

Return the authenticated HTTPS clone URL for a repo + a credential-helper hint. Use this instead of embedding tokens in URLs. Returns {url, owner, repo, defaultBranch, hint} using the repo's stored casing.

Close an open issue. Requires authenticated caller with write access. Idempotent — closing an already-closed issue is a no-op. Returns {state}.

Close an open pull request without merging. Requires authenticated caller with write access. Idempotent. Returns {state}.

Add a comment to an existing issue. Requires authenticated caller with write access. Returns {commentId}.

Add a comment to a pull request. Requires authenticated caller with write access. Returns {commentId}.

Commit the saved resolutions for a PR's conflicts ON THE PR HEAD as a two-parent merge commit (old head, base tip) — never on the base branch — moved through the push gates so CI runs on it before anything merges. Every unresolved file needs a draft (merjax_resolve_pr_conflict) or an entry in `resolutions`; files the merge rules settle are settled automatically. Both shas are compare-and-swapped: a branch that moved since is refused with nothing changed. The commit carries `Conflict-Resolution:` trailers; a gluecron[bot] comment records it. Requires write access and 'repo' scope.

Mint a new agent-multiplayer session. Returns the plaintext `token` exactly once (store it). Requires 'admin' scope.

Create a new branch ref pointing at an existing sha. Mirrors POST /api/v2/repos/.../git/refs. Gated like a push of the new branch (rulesets, secret scan of commits no other ref reaches) and fires CI/webhooks. Requires 'repo' scope. Returns {ref, sha}.

Mint a short-lived, repository-scoped HTTPS clone credential (a deploy token) for a sandbox or CI box that has no PAT. By default it returns NO token: {id, exchangeUrl, exchangeExpiresAt, gitConfig, url}. Run the gitConfig lines right before the first clone/fetch (the URL is single-use and dies in 60 s) and git fetches the token itself, so it never enters your transcript. Read-only by default; `read_only: false` asks for push access and is granted only if you have write access. Expires in 2 h by default (`expires_in_hours`, max 24). Needs owner / collaborator / team / org access to the repo (public read is not enough) and 'repo' scope. Audit-logged. Pass `token_id` (an id this tool returned) for a fresh exchange URL for the same grant; each exchange rotates the secret. `deliver: "token"` returns a read-only secret in the result instead (refused for push access: a push-capable secret in an agent's transcript outlives the run). Revoke the grant with merjax_revoke_token {type: "deploy", id}.

Create a new issue on a Merjax repository. Requires authenticated caller with write access on the target repo. Returns {number, url}.

Open a new pull request. `head_branch` is required; `base_branch` defaults to the repo default branch. Requires authenticated caller with write access. Returns {number, url}.

Mint a fine-grained repository token (`gcft_…`) for ONE repository and return it once. It authenticates the REST API (/api/v2 and the GitHub-compatible /api/v3), git over HTTPS and the container registry (images under owner/repo, by contents) for that repository only. `permissions` sets none/read/write for contents, issues, pull_requests, statuses and actions, and none/read for runners (admin and settings are never grantable); `expires_in` is optional: omit it (or "never") for no expiration, or give seconds or "30m", "12h", "7d", "1y" (min 5 minutes, max 1 year). Effective access is always held to YOUR current access to the repo, re-checked on every use, and branch protection applies as it does to you. Needs 'repo' scope. Audit-logged. Returns {id, name, repository, permissions, expiresAt, tokenPrefix, token}.

Create a one-time CI runner registration token for an owner (your username, an org you own or admin, or 'platform' as a site admin). A runner started with RUNNER_REGISTRATION_TOKEN=<token> registers once and gets its own long-lived credential; that owner's CI then runs on it. Expires in an hour. Pass exclusive: true for a label-only runner (a Mac for Xcode, a GPU box): it takes only jobs whose runs-on names its labels (e.g. [self-hosted, macos, xcode]), never runs-on: self / ubuntu-*, and the account keeps its shared lane; repositories narrows it to some of the owner's repositories. Both are fixed for the runner's life. Returns {owner, token, expiresAt, exclusive, repositoryIds, gluecronUrl}.

Delete a branch the way `git push --delete` would: write access, then branch protection (allow_deletion), rulesets and the push inspection apply; webhooks and CI fire. The default branch is never deleted. Pass expected_sha to delete only if the branch still points there. A missing branch is a not-found error. Mirrors DELETE /api/v3/repos/:o/:r/git/refs/heads/:branch. Audit-logged. Returns {branch, sha, deleted: true}.

Delete a comment on an issue or pull request (by comment id), with its edit history. Its author or a repository writer only. A missing comment is a not-found error, never reported as deleted. Mirrors DELETE /api/v3/repos/:o/:r/issues/comments/:id. Audit-logged (who wrote it, never what it said). Returns {id, kind, number, deleted: true}.

Delete a file from a branch via git plumbing. Requires the existing blob sha (optimistic concurrency) and 'repo' scope. Meets the same branch protection, rulesets and secret scan as a git push, and fires CI/webhooks like one. Mirrors DELETE /api/v2/contents.

Delete a hosted-loop (or organisation-level) secret by name. Pass loop (the hosted Claude loop's id, from /connect/claude/deploy) for the loop's own secret — its owner only — or org (organisation slug, admin-scoped token) for an organisation-level secret every loop of the organisation inherits; a loop-level name overrides the organisation's. ANTHROPIC_API_KEY is the loop's model key (CAP-S.8: the platform never lends its own); at organisation level it is the BYOK override. A secret that does not exist is a not-found error, never reported as deleted. Audit-logged. Returns {name, deleted: true}.

Delete a repository — a SOFT delete (2026-10-19): it disappears at once from git, web, REST, MCP, CI, webhooks, search and pages, its name stays reserved, and it can be restored with merjax_restore_repo until restorable_until (90 days by default). Queued/running CI is cancelled and pending webhook deliveries are stopped. Only the repository OWNER (the personal owner, or an org owner for an org repository) or a site admin may — admin collaborators and org admins are refused, as in the web UI. Requires 'admin' token scope. Audited as repo.delete; the owner is notified. To remove it for good before then, use merjax_purge_repo. Returns {deleted: true, soft: true, id, restorable_until}.

Delete one workflow secret from a repository by name (cron_secret is read as CRON_SECRET). Idempotent: deleting a secret that is already gone succeeds with deleted:false, already_deleted:true, so a retry is safe. Workflows that reference it stop receiving it. Needs admin access to the repository and 'repo' scope. Audit-logged (name only). Returns {repository, name, deleted, already_deleted, at}.

Delete an Actions variable by name. Pass owner + repo for a repository variable, owner + repo + environment for an environment variable, or org for an organisation variable (organisation variables need an admin-scoped token). A variable that does not exist is a not-found error, never reported as deleted. Audit-logged. Returns {name, deleted: true}.

Dismiss the standing 'changes requested' reviews on a PR (all of them, or one reviewer's), so they no longer hold the merge. Requires 'repo' scope and write access; the reason is required and audited.

Replace the text of a comment on an issue or pull request (by comment id). Its author or a repository writer only; the previous text is kept in the edit history; the same text again is `unchanged`; a concurrent edit is a conflict, never overwritten. Mentions the edit adds are notified. Mirrors PATCH /api/v3/repos/:o/:r/issues/comments/:id. Returns {id, kind, number, effect}.

Explain a failed CI run: for each failed step, its class (compile / test / flaky / dependency / env / infra / lint / security / unknown) and the rule that chose it, the normalised error signature, failing tests, the files the commit touched, prior occurrences of the same failure (this repo, your other repos with the same owner or org, and platform-wide counts only) with the fix rate, and a suggested fix — the commit / PR that fixed it last time plus its diff limited to the relevant files, or the class's standard remedy. Infra and flaky failures never suggest a code change. `run_id` is the run's full id; with `owner` + `repo` an 8+ hex prefix also works.

Return the cached AI 'explain this codebase' Markdown for a repo. Pure read — never triggers a new generation (use the web UI for that).

Find definitions of a symbol by name within a repo. Wraps src/lib/symbols.findDefinitions.

Fork a repository to the authenticated caller's namespace. Mirrors POST /:owner/:repo/fork. Returns {owner, repo, url}. Requires 'repo' scope.

Generate a commit message for a diff. Same engine as merjax_generate_pr_description but explicit for the commit-message use case.

Generate an AI commit-message-style description for a diff. Uses src/lib/ai-commit-message.ts under the hood; gracefully degrades to a heuristic when ANTHROPIC_API_KEY is missing. Returns {subject, body}.

Generate release notes between two tags. Wraps src/lib/ai-release-notes.generateReleaseNotes. Returns the rendered Markdown + section data.

Generate tests for a PR via Claude. Wraps src/lib/ai-test-generator.generateTestsForPr. Mode 'follow-up-pr' opens a new PR; 'append-commit' commits onto the head branch. Requires 'repo' scope.

Return spent / cap / remaining cents for an agent session.

Read the branch-protection rule that applies to a branch (exact name or the glob that covers it): required checks, require_pr_run, required approvals, AI / human review, green gates, force-push / deletion, auto-merge; plus `merge_train` {on, batch_max, effective_batch_max, host_ceiling} — whether the merge train runs for the repository and how many armed PRs it tests together; plus `gate_test` {enabled, server_configured, state: on | disabled_in_settings | not_configured_on_server, details} — whether GateTest scans the repository (set it with merjax_update_repo gate_test_enabled). Read-only. Returns {protected: false, merge_train, gate_test} when no rule applies, else {protected: true, pattern, matched_by, required_checks, …, merge_train, gate_test}.

Fetch a single commit by SHA: metadata plus the list of files it changed (path, status, additions, deletions). Mirrors GET /api/v2/repos/.../commits/:sha. Patch bodies are NOT included — use merjax_get_diff for those.

Read the actual changes in a commit or a branch range. Pass `sha` for one commit against its first parent, or `base`+`head` for everything head adds since the merge base (what a PR proposes). Returns {files:[{path, oldPath?, status, additions, deletions, binary, patch, patchTruncated}], stats, truncated}. Patch text is byte-capped; set include_patch=false for a files-changed summary only.

Fetch the full detail record of a pull request (title, body, state, branches, draft, author, timestamps), plus `mergeable` (true / false / null unknown) and `mergeState` from the same conflict probe the merge gate uses: status up-to-date | clean | conflicts | unknown, the unresolved files with their kinds, the files the merge rules settle, and conflictsUrl; and `conflictRisk` (early warning): level none | overlap | conflicts, the files the base changed since the PR branched that the PR changed too, and updateIsClean when updating now would merge cleanly. Authenticated callers only (the read tool surface still works anonymously).

List every check at a PR's current head — workflow runs, gates and commit statuses — with status, conclusion, whether branch protection requires it, and the run's log URL; plus each required check's state (passing / pending / failing / missing) and the merge gate's own CI verdict. A failed workflow run carries `failure`: the failed job and step, up to 8 file:line rows linked to the head sha, the tool's own guidance block ("What now?"), `budget` when a time budget rather than a test stopped the step (run conclusion `timed_out`: still blocks the merge), and the full step log URL — or `{withheld, required, hint}` when this credential may not read the run's logs (a private repository needs 'repo' scope). Read-only. Returns {head_sha, total_count, check_runs, required, ci}.

Return the branch-preview URL + status for a (repo, branch) pair. Wraps branch-previews.getPreviewForBranch. Returns {ok:false, reason:'not enabled on this host'} when the host has no PREVIEW_DOMAIN (no preview would ever resolve).

One of your tokens by type and id (from merjax_list_tokens): everything list shows plus the audit trail (create, edits with a before/after diff, rotations, revocation). Never the secret. `type` is pat (personal access token, glc_), repo (repository token, gcft_) or deploy (deploy token, gcdt_). Same scopes as merjax_list_tokens.

Read one Actions variable by name. Pass owner + repo for a repository variable, owner + repo + environment for an environment variable, or org for an organisation variable (organisation variables need an admin-scoped token). Not found is an error. Returns {name, value, createdAt, updatedAt}.

Return a workflow run's logs plus a failure summary. Always includes run metadata (number, workflow, event, ref, sha), per-job and per-step status / exit code / duration, `failedSteps` (`job / step`) and `testFailures` (failing test names, read from each step's structured results parsed before its log was cut, or the reason they cannot all be named; null when no job failed). `testFailures.details` marks each failure `flaky` (an active forensic label with a repro, from another run — with its label and flip rate), `known` (also failing on the default branch's latest run), `infra` (timed out under load) or `new`, with its file, message, the targeted retry's verdict and this run's determinism-forensics finding (`forensic`: class, label, variable, repro) when they ran. A step whose log was cut carries `fullLog` (artifact download of the uncut output). `step` (a step name or 1-based position within its job) returns only that step's stdout/stderr; `tail_lines` keeps the last N lines. The full per-job logs are included only when neither is given. JSON-friendly companion to the ZIP-download endpoint. A private repository's logs require 'repo' scope (OAuth: write:repo); every token read is audited. For a read-only CI audit credential, a repository token with {"runners": "read", "actions": "read"} (the ci-audit preset, merjax_create_repo_token) reads the same masked logs over REST — GET /api/v2/repos/:owner/:repo/actions/runs/:id/logs, or one job's at actions/jobs/:job_id/logs — under the same rule and audit; repository tokens are not accepted on /mcp.

Fetch a workflow run's metadata + status. Mirrors GET /api/v2/repos/.../actions/runs/:id. Also says how it relates to automatic retries: `retryOf` / `retryOfRunNumber` (the run this one retries after a deploy or a lost runner) and `retriedAs` ({id, runNumber} of the run that retried this one, or null). A queued run that no runner can take carries `queueReason` (e.g. "waiting for a runner: 2 configured, 0 reachable, last seen 4m ago"). `workClass` (interactive / review / push / schedule — how the CI claim shares slots); a queued run carries `queue` ({code, text}: its place in the claim order, from the claim plan itself); a schedule run carries `coalescedFires` / `lastCoalescedAt`, and `coalescedNote` when later scheduled fires folded into it while it was queued.

Start here when picking up work: the live state of a repository, read from git and CI rather than from a handoff doc. Returns `summary` (one paragraph), `blockers` (most urgent first), the default branch's CI per workflow (red streak, since when, last green run), the build this Merjax instance serves and how many commits it is behind (when it is this repository), every open PR grouped green / pending / failing / draft as the merge gate judges it, PRs merged in the last `merged_since_hours` (default 48), the CI queue, and — when the default branch carries `docs/plans/capacity-plan.json` — `plan`: the next items, items in flight, decisions waiting on the owner and drift between the ledger and the PRs; and `plans`, the same for every `docs/plans/*-plan.json` ledger (each read with the `idPrefix` it declares, default CAP; at most 10). Read-only.

Site admins only (needs an 'admin'-scoped token). Import a third-party GitHub Action at ONE tag, branch or full commit SHA into the Merjax mirror namespace (gluecron-actions/<owner>--<repo>), so workflows that say `uses: owner/repo@ref` can run it. Workflow runs never fetch from github.com; an action that is not imported is skipped. Re-importing the same ref updates it to what upstream has now. Audit-logged. Returns {action, ref, sha, previousSha, mirror, upstreamUrl, hasActionYml}.

Attach one or more labels to an issue. Labels are created if they don't yet exist on the repo. Requires 'repo' scope. Returns {labels}.

Site admins only (needs an 'admin'-scoped token). Whether CI failures are being turned into lessons: classified failures, lesson.pattern events (matched to a docs/ops/CI_GATE_LESSONS.md row, or candidates), recurring candidates, and failures left without a lesson for over an hour, over 7 days. 'N failures, 0 lessons' reads RED. Also each pattern's count and register row, and the register. Counts only: no log text or repository. Returns {health, patterns, register}.

The three provider workspaces every model call is billed to by its purpose (ws-control-plane, ws-hosted-loops, ws-ci-gates): each with its daily spend limit, rate limit, today's spend and calls (UTC day), and the platform ceiling above all three. Site admins with an admin-scoped token only. Mirrors GET /api/v2/admin/ai-workspaces. Returns {day, platformDailyCents, workspaces:[{workspace, purpose, dailyCents, rpm, spentToday, callsToday, callsLastMinute, updatedAt, updatedBy}]}.

List deleted repositories you can restore or purge: your personal ones and those of organizations you own (a site admin may pass all: true for the whole instance). Each has its id, full_name and restorable_until — after that date it is purged automatically. Read-only. Needs 'repo' scope. Returns {total_count, repositories:[{id, full_name, private, deleted_at, deleted_by, restorable_until}]}.

List a repository's flaky tests. A test is flaky only with a forensic repro: when it failed, CI re-ran just that test in the same order, alone, with the clock shifted +137 ms and +1 s, in TZ=Pacific/Chatham and in a fixed random order, and a variable flipped its verdict N times in a row on the same git tree. Each entry has the test, file, state (active / expired / resolved, or unexplained = flipped with no repro, NOT flaky), label (clock-dependent, order-dependent, concurrency-dependent), the variable, the exact repro command, owner, expiry, issue number, flip rate and evidence runs. Information only — flaky tests are never skipped or quarantined; one targeted retry, and the merge gate excuses a failure only when that retry passed in the same run and the label is active.

List the secrets a hosted Claude loop (or an organisation) holds — names and dates, never values. Pass loop (the hosted Claude loop's id, from /connect/claude/deploy) for the loop's own secret — its owner only — or org (organisation slug, admin-scoped token) for an organisation-level secret every loop of the organisation inherits; a loop-level name overrides the organisation's. ANTHROPIC_API_KEY is the loop's model key (CAP-S.8: the platform never lends its own); at organisation level it is the BYOK override. Returns {scope, secrets:[{name, scope, createdAt, updatedAt, lastUsedAt}], inherited:[…]} where inherited are the organisation-level names a loop gets unless it overrides them.

List every comment on a pull request in chronological order: general comments (kind `issue_comment`), inline review comments (`review_comment`: path, line, thread {id, inReplyToId, position, replies, resolved, resolvedAt, resolvedBy}) and review summaries (`review`: state approved | changes_requested | commented). Each entry has author {login, type user|bot}, isAi (written by a model: false for gluecron[bot]'s own notes, e.g. a person's conflict resolution or a merge-train notice), onBehalfOf (on such a note, the person it was posted for), body, createdAt, updatedAt. A review thread is the inline comments on one file+line; the earliest is its root and holds the resolved state. Merjax does not store a review comment's commit or diff side, so `commitId` and `side` are always null. Only approved (moderated) comments; unsubmitted draft reviews are private to their author and not listed. `kind`: all (default) | issue | review (review comments + review summaries). `since`: ISO-8601 — only entries updated at or after it. Paged: `total` is the full filtered count, `nextOffset` pages through it. Works anonymously on public repos; private repos need read access.

What stands between a PR and a clean merge, as the merge gate, the PR page and the Conflicts tab see it (one shared probe): status up-to-date | clean | conflicts | unknown, `mergeable`, the base/head shas the answer is for, files settled with no one in the loop (ruleSettled: each with `by` = structured (structured, code-aware merge) or rules (the deterministic merge rules)), and each unresolved file with its kind in plain words (both edited / binary / deleted on one side / added on both / rename / submodule / too large), whether the browser can edit it or only keep one side, and any saved draft. With hunks: true, each editable file's diff3 text labelled by branch name and its hunks (id, mine, base, main) for merjax_resolve_pr_conflict. Also the exact git commands for the command line. Read-only.

List pull requests on a repo, filtered by state (open|closed|merged|all). Authenticated callers only. Returns up to 50 summary rows.

Pull requests that are green and clean and that nobody has merged: open, not a draft, CI green at the head, no gate failing or running, no standing request for changes, branch protection satisfied, no conflicts (the merge gate's own conflict probe), and auto-merge NOT armed. Each comes with a plain sentence ("Green and clean for 3 days — nobody has merged it"), whether you can merge it (canMerge) or arm it (canArm), and the merge / arm endpoints. Also `waiting_on_you`: open PRs where you are a requested reviewer or code owner and have not reviewed. Scope: owner + repo for one repository; org for an organisation; neither for every repository you can merge in. `not_ready` lists the other open PRs in scope with the first reason. To act: merjax_set_auto_merge (arm) or merjax_merge_pr. Read-only.

List a repository's workflow secrets — NAMES ONLY, with created/updated times; values are never returned. Use it to check that a secret such as CRON_SECRET exists before a workflow needs it. Needs admin access to the repository and 'repo' scope. Returns {repository, total_count, secrets:[{name, created_at, updated_at}]}.

List the fine-grained repository tokens you have minted (never the secret): repository, permissions, state (active / expired / revoked), expiry and last use. Needs 'repo' scope.

List the CI runners registered to an owner (username, org slug, or 'platform'): id, name, url, labels, slots, online, last seen, revoked; allowSharedOverflow (the setting); and sharedLane, whether the owner's jobs actually run on shared runners: 'used (no own runners)', 'overflow allowed' or 'not used (own runners only)', explained in sharedLaneDetail. Needs a PAT with 'repo' scope (or a session) and the right to manage the owner's runners. For a read-only credential — a security audit watching for rogue runners — mint a repository token with {"runners": "read"} (merjax_create_repo_token) and call GET /api/v2/repos/:owner/:repo/actions/runners: it lists the same runners and lane and can do nothing else (repository tokens are not accepted on /mcp). Add {"actions": "read"} (the ci-audit preset) and the same token also lists workflows, runs and jobs and reads their masked logs, still with no write anywhere.

Today's model spend (UTC day), the daily bucket in force and the state (active | suspended) of every personal access token of yours, as /settings/tokens/spend shows it. Canary tokens are not listed: they never authenticate. Needs `user` scope. Returns {platformDefaultCents, tokens:[{tokenId, name, tokenPrefix, spentTodayCents, bucketCents (0 = no bucket), bucketSource: own|default, state, suspendedAt, suspendedReason, suspendedSpentCents}]}.

List your own tokens (never a secret): type, name, status (active / expiring / expired / revoked / never_used / stale), last 4 characters, scopes or permissions, repository, expiry, last use (time, IP, client), use count and rotation state. `type` is pat (personal access token, glc_), repo (repository token, gcft_) or deploy (deploy token, gcdt_), or omit it for all three (types your token's scopes cannot read are listed under `omitted`). PATs need 'user' scope to read; repository and deploy tokens need 'repo'.

List directory contents at a ref. `path` scopes the listing to a subtree and is honoured in BOTH modes; `recursive: true` walks the whole subtree instead of one level. Always returns the same shape: {path, ref, recursive, entries, truncated, totalCount}. Recursive entries carry full repo-relative paths; non-recursive entries carry names. A ref that does not exist is an error, never an empty listing.

List Actions configuration variables (${{ vars.NAME }}) with their values. Pass owner + repo for a repository variable, owner + repo + environment for an environment variable, or org for an organisation variable (organisation variables need an admin-scoped token). Admin of the repository or organisation only. Paged: limit (≤100, default 30) / offset. Mirrors GET …/actions/variables. Returns {scope, total, limit, offset, nextOffset, variables:[{name, value, createdAt, updatedAt}]}.

List a repository's workflow runs, newest first, with optional branch/status/event filters. Mirrors GET /api/v2/repos/.../actions/runs. The companion to merjax_get_workflow_run / merjax_cancel_workflow_run — this is how an agent finds the run ids to inspect or cancel (issue #10493: without it, stale queued runs could not be discovered from the tool surface at all). Needs read access to the repository. For a read-only CI audit credential (no code, no secrets, no writes), mint a repository token with {"runners": "read", "actions": "read"} (the ci-audit preset, merjax_create_repo_token) and call GET /api/v2/repos/:owner/:repo/actions/runs (and actions/workflows, actions/runs/:id/jobs): repository tokens are not accepted on /mcp.

Merge an open PR. Enforces the same checks as the HTTP merge flow: not a draft, head SHA resolves, GateTest+AI-review hard gates pass, branch-protection rules satisfied. M3: soft-blocks when the pre-merge risk score is `critical` unless `confirm_high_risk: true` is passed. Returns {merged, sha?, reason?, riskScore?}.

Open a draft pull request. Same payload as merjax_create_pr but forces is_draft=true. Useful for AI-in-progress PRs that shouldn't run mergeability checks yet.

Compute a one-shot status summary for a PR: state, risk score (and whether it describes the current head), CI state for the head commit as the merge gate sees it (with `ci.failures`: for each failed run, the failed step, up to 8 file:line rows linked to the head sha, the tool's own guidance block and the full step log URL, or `{withheld, required, hint}` when this credential may not read the run's logs), AI-review verdicts (trio), gate signals, `merge` — the conflict probe the merge gate uses (status up-to-date | clean | conflicts | unknown, unresolved files with kinds, files settled by structured merge or the merge rules, conflictsUrl), `conflictRisk` — the early warning (files the base changed since the PR branched that the PR changed too; updateIsClean when updating now would merge cleanly), auto-merge (armed? `last_attempt.reason` says what it waits for or what happens next), and `mergeTrain.lastDequeue` — the merge train's newest receipt for a green merge preview it did not merge (which commit, which runs, why). Read-only.

Press the platform kill switch: pause every model call and suspend every personal access token minted or used in the last N hours (KILL_SWITCH_WINDOW_HOURS, default 24), platform-wide. Git, CI, merges and deploys are unaffected. One forensic audit row (security.kill_switch) names every suspended token and its previous expiry; every site admin is alerted. Site admins with an admin-scoped token only. Not idempotent: a second press suspends whatever the window holds then. Mirrors POST /api/v2/admin/security/kill-switch. Returns {at, windowHours, suspended, aiWasPaused, auditId, effect}.

Move a QUEUED workflow run into the priority lane: the runner claims it ahead of the class order, highest `level` first (normal < high < critical), then oldest (issue #10898). The lane holds at most a third of the runner slots, so prioritizing many runs cannot starve the rest. Calling again on a prioritized queued run changes its level. Only queued runs; a running or finished run is reported, not changed. Requires 'repo' scope and write access; `high` and `critical` also require a site admin.

Manual trigger for the AI doc-update flow: scans tracked sections on the default branch and opens a PR rewriting stale prose. Requires 'repo' scope.

Propose a dependency-upgrade PR. Wraps src/lib/migration-assistant.proposeMajorMigration. Requires 'repo' scope.

Ask AI (Opus 5.5) to PROPOSE a resolution for each conflict block of a PR's text files — the Conflicts tab's 'Propose resolutions' button. Nothing is committed: each proposal (the block's lines, an explanation, a confidence 0..1) is stored for the (base, head) pair and shown on the Conflicts tab and in merjax_list_pr_conflicts (`unresolved[].proposal`); accept a block with merjax_resolve_pr_conflict `choices: {<hunk id>: 'ai'}`, edit it with a custom choice, or pick another option, then merjax_commit_pr_conflict_resolution. Refused when the repository's merge-conflict mode is Manual only, when the PR author opted out of AI for conflicts, or when AI is unavailable (paused, not configured, over budget) — the error says which. A file over 60 KiB is reported too-large; repository text is sent as fenced data with secrets redacted. A file already proposed at this pair is not sent again unless again: true. Requires write access and 'repo' scope.

Provision (or re-provision) a sandbox for a PR. Wraps pr-sandbox.provisionSandbox. Requires 'repo' scope. Returns {ok:false, reason:'not enabled on this host'} when no sandbox provisioner runs on the host.

PERMANENTLY delete an already-deleted repository now, instead of waiting for its restore window to end. IRREVERSIBLE: the git data, LFS objects, issues, PRs, releases, packages, CI history and settings are removed and cannot be restored (data already in the instance's backups ages out on the backup schedule). Only works on a repository already deleted with merjax_delete_repo; `confirm` must be its full name (owner/name). Owner (personal owner, or an org owner) or a site admin; needs 'admin' scope. Audited as repo.purge. Returns {purged: true, id, full_name}.

Read a file from a repo at a given ref. Mirrors GET /api/v2/repos/:owner/:repo/contents/:path. Returns {path, size, content, encoding, totalLines}. Pass `start_line` / `end_line` (1-based, inclusive) to read only part of a text file. A text file over ~60 KB read with no range returns its first ~60 KB of whole lines with `truncated: true`, `startLine`/`endLine` and a hint — ask for the next range to read on.

Plan + execute a refactor that spans multiple repos owned by the caller. Wraps src/lib/multi-repo-refactor.ts. `dry_run: true` returns the plan only. Requires 'repo' scope.

Release a lease by id. Idempotent. Returns {released}.

Reopen a previously closed issue. Requires authenticated caller with write access. Idempotent. Returns {state}.

Return the cached AI 'explain this codebase' Markdown for a public repo (most recent commit). Returns null when no cached explanation exists yet.

Compute the current health report for a public repo: overall score (0-100), letter grade, per-category breakdown (security/testing/complexity/dependencies/documentation/activity), and a list of insights to fix next. Backed by computeHealthScore in src/lib/intelligence.ts.

List open issues for a public repository. Returns up to 50 ordered by most-recent.

The repository's letter rating A+/A/B/C/D/F — the health report's grade (the same number merjax_repo_health and the /health page show; A is 85+) — with the score, the six categories (score, weight, points still available), `to_a`: the ordered list of concrete items that move the repository to A (each with the action, the points available, whether a loop can do it mechanically, and the evidence: file:line for a security finding, counts otherwise), then the delivery blockers beside it (red default branch, conflicting PRs, PRs red for a week, open ai:repair issues, issues older than 30 days — shown under `delivery`, never merged into the letter), and the last 30 recorded days. Owner mandate 2026-11-04: every repository should be A. Read-only.

Read a single file from a repository at a given ref (branch / tag / commit). Private repos are readable when the authenticated caller has access. Returns the text content (binary files rejected).

Search Merjax repositories by keyword (name + description), case-insensitively. Returns public repos plus any private repos owned by the authenticated caller. Default 20 per page, max 50; `total` is the full match count and `nextOffset` pages through it.

Request changes on a PR. Records a 'changes requested' review by the caller, which holds the PR on every merge path (web button, API, MCP merge, merge queue, merge train, autopilot) until the caller approves or someone with write access dismisses it (merjax_dismiss_review), and posts the body as a comment. Requires 'repo' scope and write access.

Re-run a failed or cancelled workflow run at the SAME commit (same inputs, same PR merge preview) — the run page's Re-run. Merjax re-runs every job of the run (per-job re-run does not exist yet); a successful or still-running run is refused. Joins an identical queued run instead of stacking another. Requires write access and 'repo' scope. Returns {runId, previousRunId, joinedExistingRun, url}.

Save a resolution for ONE conflicted file of a PR, as a draft for the exact (base_sha, head_sha) pair merjax_list_pr_conflicts returned (a moved branch is refused: reload). Pass exactly one of: `content` (the whole resolved file — no conflict markers, at most 512 KiB), `choices` (hunk id → 'mine' | 'main' | 'both-mine-first' | 'both-main-first' | 'base' | 'ai' (the block's AI proposal from merjax_propose_pr_conflict_resolution) | {kind:'custom', lines:[…]}; applied server-side, a stale hunk id is refused), or `keep` ('mine' = the PR branch's version, 'main' = the base branch's; the only options for binary files and files one side deleted). Nothing is committed until merjax_commit_pr_conflict_resolution. Requires write access and 'repo' scope.

Restore a deleted repository by id (from merjax_list_deleted_repos) before its restorable_until date: git data, LFS objects, issues, PRs, collaborators and webhooks come back exactly as they were. Cancelled CI runs stay cancelled and stopped webhook deliveries are not re-sent. Refused when another repository now has the same name in that namespace. Owner (personal owner, or an org owner) or a site admin; needs 'admin' scope. Audited as repo.restore. Returns {restored: true, id, full_name}.

Resume one of your personal access tokens that suspended itself (daily bucket spent, or the tripwire): it authenticates again; today's spend still counts against its bucket, so raise the bucket first with merjax_set_token_bucket if it is spent. A suspended token cannot make this call itself: use another credential. A token that is not suspended is `unchanged`; another person's token is not found. Needs `user` scope. Audit-logged. Returns {tokenId, name, resumed, effect}.

Approve or reject a workflow run's jobs waiting on a protected environment (`environment:` with required reviewers). The caller must be a reviewer of every environment selected (the environment's reviewers, or the repository owner when none are listed). An approval runs the job (after the environment's wait timer, if any); a rejection fails it. Mirrors POST /api/v2/repos/.../actions/runs/:id/pending_deployments. Requires 'repo' scope.