coder / coder/blink

GitHub tools `list_user_installations` and `list_app_installations` fail with app installation auth

Open
#110 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
164
Forks
18
Avg merge
1m
Merged PRs (30d)
4

Description

## Problem

The `list_user_installations` and `list_app_installations` tools fail when using GitHub App installation authentication (the default auth method in scout-agent).

### Errors

**`list_user_installations`:**
```
Resource not accessible by integration - https://docs.github.com/rest/apps/installations#list-app-installations-accessible-to-the-user-access-token
```

**`list_app_installations`:**
```
A JSON web token could not be decoded - https://docs.github.com/rest
```

## Root Cause

These two endpoints require different authentication than what `authenticateApp()` provides:

| Tool | Endpoint | Required Auth | What we provide |
|------|----------|---------------|----------------|
| `list_user_installations` | `GET /user/installations` | User access token (OAuth/PAT) | Installation token |
| `list_app_installations` | `GET /app/installations` | App JWT (signed with private key) | Installation token |

When `withContext({ appAuth })` is used, the `authenticateApp()` function exchanges the app JWT for an installation access token. This works for most repository operations, but these two endpoints specifically need different token types.

## Suggested Solutions

1. **Remove these tools from the default toolset** when using app auth, since they're not compatible
2. **Add a separate auth path** for `list_app_installations` that uses the raw JWT instead of exchanging it for an installation token
3. **Document the limitation** so users know these tools require user token auth
4. **Throw a more helpful error** when these tools are called with incompatible auth (e.g., "This tool requires a user access token and is not compatible with GitHub App authentication")

## Reproduction

1. Set up scout-agent with GitHub App auth
2. Call either `github_list_user_installations` or `github_list_app_installations`
3. Observe the errors above

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.