[bherila]

Motivation

• Close an authorization gap where AI chat could advertise and execute Git-backed repository-exploration tools (e.g. read_repo_file) for callers holding only ProjectsRead/ProjectsWrite, allowing repository contents to be fetched with stored provider credentials.
• Prevent low-privilege callers from prompting the model to exfiltrate repo files via the agentic tool loop by ensuring tool visibility and execution are bounded by repository-read permissions.

Description

• Require the git_repositories:read permission before advertising repository exploration tools by checking auth.has_permission(&Permission::GitRepositoriesRead) before merging the __repo_tools__ sentinel provider into the per-turn tools list in ConversationService::send_message (crates/temps-ai-chat/src/service.rs).
• Add a defense-in-depth execution-time guard that rejects or returns a permission error for unadvertised repo tool calls (read_repo_file, list_repo_dir, list_repo_branches, list_repo_tags) when the caller lacks GitRepositoriesRead in the agentic try_tool_loop routing logic (crates/temps-ai-chat/src/service.rs).
• Import Permission into the chat service and conditionally set the repo_tools provider handle so downstream execution respects the caller's permission scope.
• Add an Unreleased entry to CHANGELOG.md describing the authorization fix as required by repository conventions.

Testing

• Ran cargo fmt --check and formatting check passed.
• Ran cargo check -p temps-ai-chat --lib and the crate type-checked successfully.
• Ran cargo test -p temps-ai-chat --lib and all unit tests passed (73 passed, 0 failed).

---

Codex Task

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Added

- **devcontainer:** Prefetch cargo deps and background-build on create

### CI

- **self-hosted:** Add build/test workflow on push to bherila fork
- **self-hosted:** Recreate example-plugin web/dist before cargo check
- **self-hosted:** Also recreate temps-cli/dist placeholder
- **self-hosted:** Run hosted unit-test crate set, skip integration-heavy crates
- **self-hosted:** Exclude temps-screenshots live-browser tests

### Documentation

- Add local resource-awareness guidance to CLAUDE.md
- Emphasize local resource awareness with concurrent worktrees/agents

### Fixed

- **ai-chat:** Gate repo tools by git read permission

### Miscellaneous

- **ci:** Remove dead self-hosted-ci workflow

[bherila]

This proposal was superseded by fork PR #54, whose functional changes were included in merged upstream gotempsh#677. Upstream gotempsh#676 explicitly records this supersession.

Fork main has now been fast-forwarded to upstream main at 7250ab59b38d3138014ade7f5d6391c856eaa4f7. Closing this obsolete fork PR as part of the upstream synchronization; its branch history is retained.