Read a file from a public repository, without a credential and without a mount #679

New issue

Closed

opened 2026-08-13 18:35:36 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-13 18:35:36 +00:00

Member

Filed by Angie (ENG, claude seat) as the capability half of #633, so a tool does not close a ticket that asks for a mount layout.

633's stated need is its first line:

sirens-deep currently has no repository content access ... the agent cannot inspect its own source even though the repo is public

Its third acceptance criterion is "read access to repo contents, not just issues". That is satisfiable today with no infrastructure, and this issue is that slice. 633 keeps the mount question, which is a different size and belongs to deploy.

Why not the mount, for this need

A mount is a clone at pod start, a volume, and a permanent question about what re-syncs it. A mounted clone is stale the moment anything merges, which for this repository today is several times an hour, so an agent reading its own source from a mount would frequently be reading yesterday's.

An API read is current by construction.

Why no credential

The same reason list_public_repos needs none: public content is public. The issue-only Forgejo grants 633 describes are not a constraint on an unauthenticated read.

Holding no token is the guarantee, rather than a visibility filter. A filter is a line of code that can be regressed; no credential cannot see a private repository at all.

Shape

read_public_file, sibling to list_public_repos. Owner, repo, path, optional ref. Bounded output like the fetch tool, since a source file can be arbitrarily large and a tool result cannot.

Off unless the deployment configures the forge, the posture fetch, the scratchpad and the inventory all take.

Acceptance

A public file is returned by owner, repo and path, at a named ref or the default branch.
No Authorization header is sent, asserted rather than assumed.
A file larger than the bound is truncated with the loss stated, not silently cut.
A path that escapes the repository is refused.
Unconfigured offers no tool.

Not in scope

The mount, both of 633's first two criteria, and anything that writes.

**Filed by Angie (ENG, claude seat) as the capability half of https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/633**, so a tool does not close a ticket that asks for a mount layout. 633's stated need is its first line: > sirens-deep currently has no repository content access ... the agent cannot inspect its own source even though the repo is public Its third acceptance criterion is *"read access to repo contents, not just issues"*. **That is satisfiable today with no infrastructure**, and this issue is that slice. 633 keeps the mount question, which is a different size and belongs to deploy. ## Why not the mount, for this need A mount is a clone at pod start, a volume, and a permanent question about what re-syncs it. **A mounted clone is stale the moment anything merges**, which for this repository today is several times an hour, so an agent reading its own source from a mount would frequently be reading yesterday's. An API read is current by construction. ## Why no credential The same reason `list_public_repos` needs none: public content is public. The issue-only Forgejo grants 633 describes are not a constraint on an unauthenticated read. **Holding no token is the guarantee**, rather than a visibility filter. A filter is a line of code that can be regressed; no credential cannot see a private repository at all. ## Shape `read_public_file`, sibling to `list_public_repos`. Owner, repo, path, optional ref. Bounded output like the fetch tool, since a source file can be arbitrarily large and a tool result cannot. Off unless the deployment configures the forge, the posture fetch, the scratchpad and the inventory all take. ## Acceptance - A public file is returned by owner, repo and path, at a named ref or the default branch. - No `Authorization` header is sent, asserted rather than assumed. - A file larger than the bound is truncated with the loss stated, not silently cut. - A path that escapes the repository is refused. - Unconfigured offers no tool. ## Not in scope The mount, both of 633's first two criteria, and anything that writes.

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-13 18:38:36 +00:00

feat(repos): read one file from a public repository #681

coilyco-ops referenced this issue

2026-08-13 18:38:55 +00:00

Mount all public repos into /workspace and /substrate (ward-style) so sirens-deep can read its own source #633

coilyco-ops closed this issue

2026-08-13 18:41:09 +00:00

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-13 18:43:32 +00:00

feat(repos): read one file from a public repository #683