Python: Protect custom AG-UI approval state namespaces

.github/dependabot.yml

@@ -7,10 +7,13 @@ version: 2
 updates:
   # Maintain dependencies for nuget
   - package-ecosystem: "nuget"
-    # Use the Dependabot-only solution in this folder so NuGet discovery does
-    # not expand the full developer solution, which includes samples and times
-    # out before creating update PRs.
-    directory: "dotnet/dependabot/"
+    directory: "dotnet/"
+    # The samples tree contains most of the .NET package manifests and causes
+    # the NuGet updater to exceed Dependabot's fixed execution timeout. Keep the
+    # production source, tests, and central package versions in scope so updates
+    # can be opened again.
+    exclude-paths:
+      - "samples/**"
     schedule:
       interval: "cron"
       cronjob: "0 8 * * 4,0" # Every Thursday(4) and Sunday(0) at 8:00 UTC

.github/tests/test_devflow_fix_ci_workflow.js

@@ -27,10 +27,57 @@ describe('DevFlow PR repair entrypoint', () => {
     const intake = workflow.indexOf('Validate and bind the authorized request');
     const reaction = workflow.indexOf('Acknowledge accepted repair command');
     assert.ok(reaction > intake);
+    const authStep = workflow.slice(
+      workflow.indexOf('Get source-repository App token'),
+      workflow.indexOf('Authorize the frozen command requester'),
+    );
+    assert.match(authStep, /pull-requests-permission: write/);
+    assert.doesNotMatch(workflow, /id: reaction-auth/);
+    const reactionStep = workflow.slice(reaction, workflow.indexOf('\n  repair:'));
+    assert.match(reactionStep, /github-token: \$\{\{ steps\.auth\.outputs\.token \}\}/);
+    assert.match(reactionStep, /continue-on-error: true/);
     assert.match(workflow, /steps\.intake\.outputs\.mode == 'repair'/);
     assert.match(workflow, /content: 'eyes'/);
   });
 
+  it('uses the review-proven App grant and the job token for Actions reads', () => {
+    assert.doesNotMatch(workflow, /actions-permission: read/);
+    assert.ok([...workflow.matchAll(/GITHUB_TOKEN: \$\{\{ github\.token \}\}/g)].length >= 3);
+    const authorization = workflow.slice(
+      workflow.indexOf('Get source-repository App token'),
+      workflow.indexOf('Authorize the frozen command requester'),
+    );
+    assert.match(authorization, /contents-permission: read/);
+    assert.match(authorization, /issues-permission: write/);
+    assert.match(authorization, /pull-requests-permission: write/);
+
+    const repair = workflow.slice(workflow.indexOf('\n  repair:'), workflow.indexOf('\n  approve:'));
+    assert.match(repair, /permissions:\n      contents: read\n      actions: read\n      checks: read/);
+    assert.doesNotMatch(repair.slice(0, repair.indexOf('    outputs:')), /issues: write/);
+    const repairRead = repair.slice(
+      repair.indexOf('Get read-only source-repository App token'),
+      repair.indexOf('Generate and verify the bounded repair'),
+    );
+    assert.match(repairRead, /contents-permission: read/);
+    assert.match(repairRead, /issues-permission: read/);
+    assert.match(repairRead, /pull-requests-permission: read/);
+    const report = repair.slice(repair.indexOf('Get issue-reporting token'));
+    assert.match(report, /pull-requests-permission: write/);
+
+    const publish = workflow.slice(workflow.indexOf('\n  publish:'));
+    assert.doesNotMatch(publish.slice(0, publish.indexOf('    env:')), /issues: write/);
+    const publishRead = publish.slice(
+      publish.indexOf('Get read-only source-repository App token'),
+      publish.indexOf('Revalidate exact candidate and approval before write authority'),
+    );
+    assert.match(publishRead, /issues-permission: read/);
+    assert.match(publishRead, /pull-requests-permission: read/);
+    const publishWrite = publish.slice(publish.indexOf('Get source-repository write token'));
+    assert.match(publishWrite, /contents-permission: write/);
+    assert.match(publishWrite, /issues-permission: write/);
+    assert.match(publishWrite, /pull-requests-permission: write/);
+  });
+
   it('runs private policy code and preserves the exact-diff publication gate', () => {
     assert.match(workflow, /scripts\/trigger_fix_ci\.py --phase run/);
     assert.match(workflow, /environment: devflow-pr-repair-publish/);