[bherila]

Motivation

• A sentinel provider exposed repository-exploration tools (read_repo_file, list_repo_dir, list_repo_branches, list_repo_tags) into every chat when a project had a Git connection, but tool discovery and execution were not scoped to the caller's permissions, allowing callers with ProjectsWrite but without GitRepositoriesRead to cause the server to use stored Git provider tokens and read private repo data.

Description

• Add an auth-aware discovery hook tools_with_auth to ConversationContextProvider so providers can consider the caller's AuthContext when advertising tools (new default delegates to tools).
• Update ConversationService to call tools_with_auth during tool collection and to dispatch repo tool calls via execute_tool_with_auth so the caller's AuthContext is propagated to providers.
• Change RepoToolsProvider to implement tools_with_auth and execute_tool_with_auth and require Permission::GitRepositoriesRead (checked via auth.has_permission(&Permission::GitRepositoriesRead)) before advertising or executing repo tools, returning a readable denial message when missing.
• Add a regression test ensuring forced execution without GitRepositoriesRead is denied, and update CHANGELOG.md with a security fix entry.

Testing

• Ran cargo check --lib -p temps-ai-chat, which completed successfully.
• Ran unit tests cargo test -p temps-ai-chat providers::repo_tools, which passed (all provider tests including the new permission denial test succeeded).

---

Codex Task

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Fixed

- **ai-chat:** Enforce git repo permissions for AI tools

[bherila]

The functional change was carried into upstream security-hardening PR gotempsh#676 and its merged replacement gotempsh#677. Upstream gotempsh#676 explicitly lists this fork PR in its source coverage.

Fork main has now been fast-forwarded to upstream main at 7250ab59b38d3138014ade7f5d6391c856eaa4f7. Closing this obsolete fork PR as part of the upstream synchronization; its branch history is retained.