[Changyong Gong (chagong)]

Summary

• Enforce public-only GitHub acquisition for default hosted sessions across REST, policy, pinned/indexed search, wiki, and image paths. Validate canonical public repository metadata before access and again before releasing results; public asset downloads omit App credentials.
• Add separately requested, read-only internal-analysis chat with platform-owner/profile/conversation isolation. Reject profile changes, imported platform history, previous-response references, and delegation from internal analysis.
• Restrict SDK tool, agent, permission, discovery, and memory surfaces; stop attaching generic Foundry toolbox connections. Preserve separately authorized public wiki maintenance with the same public-only profile.
• Add regression coverage and documentation, including rejection of blank standalone public-mode configuration rather than silently enabling private reads.

Compatibility and deployment prerequisites

All invocations are public-only, including Actions issue triage, direct tasks, and team-memory jobs. Private-target automation and private wiki destinations are rejected. Automatic public duplicate detection searches public candidates only; private-inclusive results remain in separate internal chat and must not be handed back to public triage. Public-target triage retains its registered capabilities and authorized writes. Confirm consumer repository/wiki visibility before deploying.

Visibility rechecks increase GitHub API traffic and are not an atomic privacy transaction. Historically public content and private material supplied directly in caller text/attachments cannot be retroactively classified or protected by repository visibility checks.

Internal analysis requires maintainer-authenticated ingress supplying a trusted platform identity. This PR does not create or verify that ingress, add per-repository maintainer authorization, or establish live hosted SDK/model routing. No deployment or production remediation verification has occurred.

This is a confidentiality-profile change, not an issue-bound write-authorization implementation, deterministic maintainer-command parser, manual workflow approval gate, or credential-broker change.

Validation

• Host/session suite: 68 passed; agent-prompt suite: 5 passed; team-memory instruction suite: 17 passed.
• Complete MCP suite: 257 passed, including public-access, visibility-change, wiki/image, and configuration regressions.
• Changed Python files compile; staged whitespace check passes.

The separately attempted full application suite is not green on this Windows environment: deployment-workflow subtests require missing jq, and an unchanged clean-ZIP packaging test encounters a Windows Rich/platform subprocess interaction. Complete Ubuntu application, MCP, packaging, and workflow CI should be reviewed before merge. No Foundry deployment was performed or requested.

[Copilot]

🟡 Changes recommended

A public-to-private repository transition can bypass the visibility recheck on HTTP 404, causing duplicate detection to report successful built-in fallback instead of denied access.

1 open issue

• Recheck repository visibility before handling public-mode 404s · New

What changed in this PR

This PR separates IssueLens GitHub access into public-only automation and default chat, plus explicitly requested, read-only internal-analysis chat.

Changes:

• Add repository visibility checks across GitHub data paths and omit App credentials from public image downloads.
• Isolate chat history by user, access profile, and conversation; restrict tools, permissions, and discovery.
• Add regression coverage and document compatibility limits and deployment prerequisites.

File	Description
tests/​test_team_memory_instructions.py	Update agent registration and tool allowlist assertions.
tests/​test_host_telemetry.py	Cover profile isolation, history rejection, and SDK restrictions.
tests/​test_agent_prompts.py	Update profile-aware prompt and client wiring assertions.
skills/​find-duplicates/​SKILL.md	Define public-result limits and private-analysis restrictions.
main.py	Configure access profiles, restricted tools, and isolated chat sessions.
github_app_mcp/​tests/​test_public_access.py	Add public-access and visibility-change regression coverage.
github_app_mcp/​src/​issuelens_github_mcp/​server.py	Default standalone MCP to public-only access.
github_app_mcp/​src/​issuelens_github_mcp/​policy.py	Prevent permission denials from becoming missing-policy fallbacks.
github_app_mcp/​src/​issuelens_github_mcp/​github.py	Enforce visibility checks and protect wiki and image access.
github_app_mcp/​README.md	Document MCP access profiles and configuration.
docs/​guide.md	Explain internal chat, compatibility, and trusted-ingress requirements.
agents/​issuelens.md	Add public-session confidentiality instructions.
agents/​internal-analysis.md	Introduce the read-only internal duplicate-analysis prompt.
.github/​copilot-instructions.md	Document profile boundaries and the internal-analysis agent.
.github/​actions/​issuelens/​README.md	Clarify public-only invocation behavior.
.env.example	Mark generic toolbox configuration as ignored.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Confidentiality depends on trusted Foundry identity ingress and live hosted SDK isolation, neither of which is established by the mocked tests and both require human rollout validation.

No open issues 🎉

1 resolved since last review

• Recheck repository visibility before handling public-mode 404s

_{Review effort: Balanced}