[codex] Fix stale extension auth and GitHub self repo listing

[serrrfirat]

Summary

• Add explicit model-visible readiness messages for configured/active extension search results.
• Add activation success messaging that tells the model no additional auth/config is needed unless a later tool raises auth_required.
• Fix github.list_repos so authenticated-user requests (username omitted, me, or @me) call /user/repos instead of the public /users/me/repos account.
• Update GitHub list-repos manifest/prompt/schema and rebuild the bundled GitHub WASM artifact.
• Cover the stale auth prompt paths and GitHub self-repo listing with regression assertions.

Root Cause

extension_search correctly suppressed stale credential requirements/onboarding for configured or active extensions, but it did not provide positive readiness evidence. In already-active flows such as “connect my GitHub”, the model could reuse older PAT onboarding text from prior search/context even though the search result was active and clean.

The later GitHub screenshot was a separate tool semantics bug, not a placeholder secret. github.list_repos required username and always queried /users/{username}/repos. When the model used username: "me" for “my GitHub repos”, GitHub interpreted that as the literal public user me, so the response showed that account's public repositories even though host credential injection was working.

Validation

• cargo fmt --all --check
• ./scripts/build-wasm-extensions.sh --first-party
• cargo test --manifest-path crates/ironclaw_first_party_extensions/assets/github/wasm-src/Cargo.toml
• cargo test -p ironclaw_host_runtime --test github_wasm_runtime_contract bundled_github_wasm_builds_create_repo_fork_and_release_requests
• cargo test -p ironclaw_reborn_composition local_dev_extension_search_hides_onboarding_after_credentialed_activation
• cargo test -p ironclaw_reborn_composition local_dev_extension_lifecycle_tools_manage_visible_extension_surface
• cargo test -p ironclaw_reborn_composition local_dev_extension_activate_returns_auth_gate_when_account_lacks_required_scope

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds user-facing success messages to commit_activation and search responses. Extracts a extension_search_has_ready_result predicate that detects configured/active extensions with no credential requirements or onboarding. Updates the builtin.extension_activate capability description and strengthens test assertions for the new messages.

Changes

Extension lifecycle success messaging

Layer / File(s)	Summary
Ready-result predicate and search/activation message wiring crates/ironclaw_reborn_composition/src/extension_lifecycle.rs	Adds extension_search_has_ready_result helper; search conditionally sets response.message when the payload has a configured/active extension with no credentials or onboarding; commit_activation sets a success message on the activation response.
Capability description update and test assertions crates/ironclaw_reborn_composition/src/extension_lifecycle_capabilities.rs	Extends builtin.extension_activate description with activated=true ignore-earlier-hints guidance; tests assert description text, activation success message, and "already configured or active" in both configured and active search responses.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• nearai/ironclaw#4996: Directly overlaps — modifies the same extension_lifecycle.rs search logic and onboarding-suppression flow this PR extends with messaging.

Suggested reviewers

• think-in-universe

Poem

🦀 A search comes back "already set!"
No onboarding nag to cause regret.
activated=true? Ignore the noise.
The message field now ships with poise.
Rust gates the rest — we just add voice.

🚥 Pre-merge checks | ✅ 2 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	Title uses non-standard brackets and doesn't follow Conventional Commits format (type(scope): summary).	Rewrite as: fix(extension-lifecycle): add readiness messages and fix GitHub self-repo listing
Description check	⚠️ Warning	Description includes comprehensive summary and validation but missing Change Type checkboxes, Linked Issue, and Reborn Trust-Boundary checklist.	Complete all required sections: check Change Type box(es), add Linked Issue reference, and complete Trust-Boundary checklist items.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[railway-app]

🚅 Deployed to the ironclaw-pr-5034 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jun 17, 2026 at 3:39 pm

[gemini-code-assist]

Code Review

This pull request improves the extension lifecycle flow by adding clear guidance messages to search and activation responses, instructing the model not to prompt users for credentials if an extension is already configured or active. It also updates the activation capability description and corresponding tests. Feedback suggests refining the helper function extension_search_has_ready_result to check for a specific authorization status rather than checking the installation phase directly, preventing unexpected popups.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

To avoid unexpected popups, auth flows on extension activation should only be triggered for scope expansion, not for initial tool configuration. This can be achieved by checking for a status like 'awaiting_authorization' instead of checking the installation phase directly.

extensions.iter().any(|extension| {
    extension.status == Some(LifecycleStatus::AwaitingAuthorization)
})

References

1. To avoid unexpected popups, auth flows on extension activation should only be triggered for scope expansion, not for initial tool configuration. This can be achieved by checking for a status like 'awaiting_authorization'.