From 06ba99231ba224e5a0f1d0b2e767d49b63ad2c64 Mon Sep 17 00:00:00 2001
From: "@daniel-lxs" <57051444+daniel-lxs@users.noreply.github.com>
Date: Mon, 17 Aug 2026 19:10:47 +0000
Subject: [PATCH 1/2] fix: let Fast mode inspect GitHub Actions failures

---
 apps/docs/providers/source-control/github.mdx | 17 ++++++
 .../settings/SourceControl.test.tsx           | 29 ++++++++++-
 .../src/components/settings/SourceControl.tsx | 52 ++++++++++++++++---
 .../trpc/commands/github/mutations.test.ts    | 25 ++++++++-
 .../web/src/trpc/commands/github/mutations.ts | 45 ++++++++++++++++
 .../fast-agent-integration-broker.test.ts     |  8 +++
 .../fast-agent-integration-broker.ts          |  5 +-
 .../router/__tests__/router-helpers.test.ts   | 11 ++++
 .../src/server/router/mcp-policy.ts           |  5 +-
 9 files changed, 186 insertions(+), 11 deletions(-)

diff --git a/apps/docs/providers/source-control/github.mdx b/apps/docs/providers/source-control/github.mdx
index 990832c6c..afab63af4 100644
--- a/apps/docs/providers/source-control/github.mdx
+++ b/apps/docs/providers/source-control/github.mdx
@@ -85,6 +85,23 @@ Grant these repository permissions:
 - **Pull requests**: Read and write
 - **Workflows**: Read and write
 
+Fast mode needs at least **Actions: Read-only** to inspect workflow runs, jobs,
+step conclusions, and available failure logs. The Roomote manifest requests
+**Read and write** because other Roomote workflows can also manage Actions; Fast
+mode still accesses GitHub through a read-only tool policy.
+
+If the GitHub App or installation predates the Actions permission, an app owner
+must add **Actions: Read-only** or **Read and write** under **Permissions &
+events**. GitHub then requires an installation owner to approve the updated
+permission. In Roomote, open **Settings > Source control** and select **Approve
+GitHub access**, then **Refresh GitHub**. A full reinstall is normally not
+required, but uninstall and reinstall the app if GitHub does not offer the
+permission approval for the existing installation.
+
+GitHub may remove logs after the repository's retention period or deny them for
+an installation that lacks access. In those cases Roomote can report run, job,
+and step metadata, but it will not claim to have inspected unavailable logs.
+
 Subscribe to these events:
 
 - **Check run**
diff --git a/apps/web/src/components/settings/SourceControl.test.tsx b/apps/web/src/components/settings/SourceControl.test.tsx
index 17413f8f4..2ceabd966 100644
--- a/apps/web/src/components/settings/SourceControl.test.tsx
+++ b/apps/web/src/components/settings/SourceControl.test.tsx
@@ -8,7 +8,9 @@ import { fireEvent, render, screen } from '@testing-library/react';
 import { toast } from 'sonner';
 
 const state = vi.hoisted(() => ({
-  gitHubInstallations: [{ id: 'gh-1' }],
+  gitHubInstallations: [
+    { id: 'gh-1', permissions: { actions: 'write' } },
+  ] as Array<{ id: string; permissions: Record<string, string> }>,
   gitHubRepositories: [
     {
       id: 'repo-1',
@@ -354,7 +356,9 @@ describe('SourceControl settings', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     state.searchParams = '';
-    state.gitHubInstallations = [{ id: 'gh-1' }];
+    state.gitHubInstallations = [
+      { id: 'gh-1', permissions: { actions: 'write' } },
+    ];
     state.gitHubRepositories = [
       {
         id: 'repo-1',
@@ -562,6 +566,27 @@ describe('SourceControl settings', () => {
     );
   });
 
+  it('guides older GitHub installations through Actions permission approval', () => {
+    state.gitHubInstallations = [
+      { id: 'gh-1', permissions: { contents: 'write' } },
+    ];
+
+    render(<SourceControl />);
+
+    expect(
+      screen.getByText(/This installation cannot read GitHub Actions runs/),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('button', { name: 'Approve GitHub access' }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole('link', { name: 'Review the setup steps' }),
+    ).toHaveAttribute(
+      'href',
+      'https://docs.roomote.dev/providers/source-control/github#permissions-and-events',
+    );
+  });
+
   it('syncs GitLab repositories from the source control section', () => {
     render(<SourceControl />);
 
diff --git a/apps/web/src/components/settings/SourceControl.tsx b/apps/web/src/components/settings/SourceControl.tsx
index 938403ca4..8a4e7fc29 100644
--- a/apps/web/src/components/settings/SourceControl.tsx
+++ b/apps/web/src/components/settings/SourceControl.tsx
@@ -58,6 +58,15 @@ import { SourceControlConfigForm } from './SourceControlConfigForm';
 
 const INITIAL_REPO_COUNT = 100;
 
+function hasGitHubActionsReadPermission(permissions: unknown): boolean {
+  if (!permissions || typeof permissions !== 'object') {
+    return false;
+  }
+
+  const actions = (permissions as Record<string, unknown>).actions;
+  return actions === 'read' || actions === 'write';
+}
+
 type Repository = {
   id: string;
   fullName: string;
@@ -243,6 +252,13 @@ export function SourceControl() {
     gitHubRepositories.isPending ||
     sourceControlConfigStatus.isPending;
   const gitHubIsConnected = (gitHubInstallations.data?.length ?? 0) > 0;
+  const gitHubNeedsActionsPermission =
+    gitHubIsConnected &&
+    (gitHubInstallations.data?.some(
+      (installation) =>
+        !hasGitHubActionsReadPermission(installation.permissions),
+    ) ??
+      false);
   const gitHubIsConfigured = isProviderConfigured(
     sourceControlConfigStatus.data,
     'github',
@@ -367,7 +383,11 @@ export function SourceControl() {
               disabled={enableGitHubApp.isPending}
             >
               {gitHubIsConnected ? <Pencil /> : <Plug />}
-              {gitHubIsConnected ? 'Update GitHub' : 'Connect GitHub'}
+              {gitHubNeedsActionsPermission
+                ? 'Approve GitHub access'
+                : gitHubIsConnected
+                  ? 'Update GitHub'
+                  : 'Connect GitHub'}
             </Button>
             {gitHubIsConnected ? (
               <Button
@@ -413,11 +433,31 @@ export function SourceControl() {
         ? 'Missing a repo here? Update GitHub, then refresh to make it available here.'
         : undefined,
       configForm: isAdmin ? (
-        <SourceControlConfigForm
-          provider="github"
-          configStatus={sourceControlConfigStatus.data}
-          saveSuccessMessage="GitHub App credentials saved."
-        />
+        <div className="space-y-4">
+          {gitHubNeedsActionsPermission ? (
+            <Alert variant="warning">
+              <AlertDescription>
+                This installation cannot read GitHub Actions runs. First grant
+                the GitHub App <strong>Actions: Read-only</strong> or higher,
+                then use <strong>Approve GitHub access</strong> to approve the
+                updated permission. Refresh GitHub after approval.{' '}
+                <Link
+                  href="https://docs.roomote.dev/providers/source-control/github#permissions-and-events"
+                  target="_blank"
+                  className="font-medium underline underline-offset-4"
+                >
+                  Review the setup steps
+                </Link>
+                .
+              </AlertDescription>
+            </Alert>
+          ) : null}
+          <SourceControlConfigForm
+            provider="github"
+            configStatus={sourceControlConfigStatus.data}
+            saveSuccessMessage="GitHub App credentials saved."
+          />
+        </div>
       ) : null,
       githubSetup: isAdmin ? (
         <GitHubAppSettingsSetup redirectTarget={redirectTarget} />
diff --git a/apps/web/src/trpc/commands/github/mutations.test.ts b/apps/web/src/trpc/commands/github/mutations.test.ts
index 77da75fc2..0a5247389 100644
--- a/apps/web/src/trpc/commands/github/mutations.test.ts
+++ b/apps/web/src/trpc/commands/github/mutations.test.ts
@@ -5,6 +5,7 @@ const {
   mockDbTransaction,
   mockEnvState,
   mockFetch,
+  mockFindGitHubInstallations,
   mockResolveDeploymentEnvVar,
   mockResolvePendingGitHubInstallations,
   mockUpsertDeploymentEnvironmentVariables,
@@ -19,6 +20,7 @@ const {
     R_GITHUB_CLIENT_SECRET: 'client-secret',
   },
   mockFetch: vi.fn(),
+  mockFindGitHubInstallations: vi.fn(),
   mockResolveDeploymentEnvVar: vi.fn(),
   mockResolvePendingGitHubInstallations: vi.fn(),
   mockUpsertDeploymentEnvironmentVariables: vi.fn(),
@@ -46,7 +48,7 @@ vi.mock('@roomote/db/server', () => ({
     transaction: mockDbTransaction,
     query: {
       githubInstallations: {
-        findMany: vi.fn(),
+        findMany: mockFindGitHubInstallations,
       },
     },
   },
@@ -81,6 +83,7 @@ vi.mock('@roomote/sdk/server/automation-recommendations', () => ({
 }));
 
 import {
+  enableGitHubAppCommand,
   finishCreateGitHubAppManifestCommand,
   resolvePendingGitHubInstallationsCommand,
   startAuthenticateGitHubAccountCommand,
@@ -121,6 +124,7 @@ describe('GitHub App manifest commands', () => {
     mockDbTransaction.mockImplementation(async (callback) =>
       callback({ kind: 'tx' }),
     );
+    mockFindGitHubInstallations.mockResolvedValue([]);
     mockResolveDeploymentEnvVar.mockResolvedValue('created-roomote-app');
   });
 
@@ -219,6 +223,25 @@ describe('GitHub App manifest commands', () => {
     });
   });
 
+  it('routes older organization installations to their permission approval settings', async () => {
+    mockFindGitHubInstallations
+      .mockResolvedValueOnce([])
+      .mockResolvedValueOnce([
+        {
+          installationId: 12345,
+          accountLogin: 'roomote-org',
+          accountType: 'Organization',
+          permissions: { contents: 'write' },
+        },
+      ]);
+
+    await expect(enableGitHubAppCommand(buildMockAuth())).resolves.toEqual({
+      success: true,
+      mode: 'redirect',
+      url: 'https://github.com/organizations/roomote-org/settings/installations/12345',
+    });
+  });
+
   it('prefers R_PUBLIC_URL for manifest callbacks, webhooks, and name when R_APP_URL is loopback', async () => {
     mockEnvState.R_APP_URL = 'http://127.0.0.1:13000';
     mockEnvState.R_PUBLIC_URL = 'https://customer.example';
diff --git a/apps/web/src/trpc/commands/github/mutations.ts b/apps/web/src/trpc/commands/github/mutations.ts
index 3f054a767..9ada815d6 100644
--- a/apps/web/src/trpc/commands/github/mutations.ts
+++ b/apps/web/src/trpc/commands/github/mutations.ts
@@ -45,6 +45,27 @@ type CloudActionResult =
   | { success: true; redirectUrl: string }
   | { success: false; error: string };
 
+function hasGitHubActionsReadPermission(permissions: unknown): boolean {
+  if (!permissions || typeof permissions !== 'object') {
+    return false;
+  }
+
+  const actions = (permissions as Record<string, unknown>).actions;
+  return actions === 'read' || actions === 'write';
+}
+
+function getGitHubInstallationSettingsUrl(installation: {
+  installationId: number;
+  accountLogin: string;
+  accountType: string;
+}): string {
+  if (installation.accountType === 'Organization') {
+    return `https://github.com/organizations/${encodeURIComponent(installation.accountLogin)}/settings/installations/${installation.installationId}`;
+  }
+
+  return `https://github.com/settings/installations/${installation.installationId}`;
+}
+
 const GITHUB_APP_DEFAULT_EVENTS = [
   'check_run',
   'check_suite',
@@ -678,6 +699,30 @@ export async function enableGitHubAppCommand(
       }
     }
 
+    const activeInstallations = await db.query.githubInstallations.findMany({
+      where: isNull(githubInstallations.suspendedAt),
+      columns: {
+        installationId: true,
+        accountLogin: true,
+        accountType: true,
+        permissions: true,
+      },
+    });
+    const installationMissingActionsPermission = activeInstallations.find(
+      (installation) =>
+        !hasGitHubActionsReadPermission(installation.permissions),
+    );
+
+    if (installationMissingActionsPermission) {
+      return {
+        success: true,
+        mode: 'redirect',
+        url: getGitHubInstallationSettingsUrl(
+          installationMissingActionsPermission,
+        ),
+      };
+    }
+
     const installResult = await startCreateGitHubInstallationCommand(
       auth,
       state,
diff --git a/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts b/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts
index cc8b4513c..df33f760d 100644
--- a/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts
+++ b/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts
@@ -99,6 +99,14 @@ describe('fast-agent integration broker', () => {
     expect(integrations.map((integration) => integration.id)).toEqual([
       'github',
     ]);
+    expect(integrations[0]).toEqual(
+      expect.objectContaining({
+        description: expect.stringContaining('GitHub Actions runs'),
+        instructions: expect.stringContaining(
+          'explicitly say that logs were not available',
+        ),
+      }),
+    );
     expect(mocks.listMcpTools).toHaveBeenCalledWith({
       url: 'https://api.example.com/api/mcp-routing/github',
       headers: { Authorization: 'Bearer control-plane-token' },
diff --git a/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts b/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts
index f1fd8af59..c4e912139 100644
--- a/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts
+++ b/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts
@@ -53,6 +53,8 @@ type IntegrationAuditContext = BrokerContext & {
 
 const FAST_AGENT_INTEGRATION_TOOL_CACHE_TTL_MS = 5 * 60_000;
 
+const FAST_AGENT_GITHUB_INSTRUCTIONS = `For a GitHub Actions run link, use actions_get to read the workflow run, actions_list to inspect its jobs and step conclusions, and get_job_logs only when failure details require logs. Prefer failed-job logs over the full run archive; request bounded log content with failed_only=true, return_content=true, and a reasonable tail_lines value. If logs are expired, unavailable, or denied, explain what the run, job, and step metadata shows and explicitly say that logs were not available; never imply that logs or annotations were inspected unless the tool result contains them.`;
+
 type IntegrationToolCacheEntry = {
   expiresAt: number;
   tools: Promise<McpToolDefinition[]>;
@@ -178,7 +180,8 @@ export async function listFastAgentIntegrations(
       id: 'github',
       name: 'GitHub',
       description:
-        'Read repositories, code, issues, pull requests, commits, and recent activity available to the deployment GitHub App.',
+        'Read repositories, code, issues, pull requests, commits, GitHub Actions runs, jobs, and failure details available to the deployment GitHub App.',
+      instructions: FAST_AGENT_GITHUB_INSTRUCTIONS,
       disabledTools: new Set<string>(),
     });
   }
diff --git a/packages/cloud-agents/src/server/router/__tests__/router-helpers.test.ts b/packages/cloud-agents/src/server/router/__tests__/router-helpers.test.ts
index 86756ab2e..cdfb3173e 100644
--- a/packages/cloud-agents/src/server/router/__tests__/router-helpers.test.ts
+++ b/packages/cloud-agents/src/server/router/__tests__/router-helpers.test.ts
@@ -435,6 +435,17 @@ describe('router helpers', () => {
     expect(isRouterMcpToolAllowed('roomote', allowedTools[0]!)).toBe(true);
   });
 
+  it('exposes only read-only GitHub Actions inspection tools', () => {
+    expect(getAllowedRouterMcpToolNames('github')).toEqual(
+      expect.arrayContaining(['actions_get', 'actions_list', 'get_job_logs']),
+    );
+    expect(getRouterMcpUpstreamConstraints('github')).toEqual({
+      readonly: true,
+      toolsets: ['repos', 'pull_requests', 'issues', 'actions'],
+    });
+    expect(isRouterMcpToolAllowed('github', 'actions_run_trigger')).toBe(false);
+  });
+
   it('includes Roomote lookup support for Slack and Discord permalink references', () => {
     expect(
       shouldIncludeRoomoteRouterLookup(
diff --git a/packages/cloud-agents/src/server/router/mcp-policy.ts b/packages/cloud-agents/src/server/router/mcp-policy.ts
index 320962cea..7fb6ddb58 100644
--- a/packages/cloud-agents/src/server/router/mcp-policy.ts
+++ b/packages/cloud-agents/src/server/router/mcp-policy.ts
@@ -90,6 +90,9 @@ const ROUTER_LINEAR_ALLOWED_TOOLS = [
 ] as const;
 
 const ROUTER_GITHUB_ALLOWED_TOOLS = [
+  'actions_get',
+  'actions_list',
+  'get_job_logs',
   'get_pull_request',
   'pull_request_read',
   'list_pull_requests',
@@ -130,7 +133,7 @@ const ROUTER_MCP_SERVER_POLICIES: Record<
     requiredToolGroups: ['github-pr-context', 'github-issue-context'],
     upstreamConstraints: {
       readonly: true,
-      toolsets: ['repos', 'pull_requests', 'issues'],
+      toolsets: ['repos', 'pull_requests', 'issues', 'actions'],
     },
   },
 };

From e7d64feb09030630c24e45717ccdcec8a33fdbaa Mon Sep 17 00:00:00 2001
From: "@daniel-lxs" <57051444+daniel-lxs@users.noreply.github.com>
Date: Mon, 17 Aug 2026 20:11:35 +0000
Subject: [PATCH 2/2] fix: narrow Fast GitHub Actions access

---
 apps/docs/providers/source-control/github.mdx | 17 ------
 .../settings/SourceControl.test.tsx           | 29 +----------
 .../src/components/settings/SourceControl.tsx | 52 +++----------------
 .../trpc/commands/github/mutations.test.ts    | 25 +--------
 .../web/src/trpc/commands/github/mutations.ts | 45 ----------------
 .../fast-agent-integration-broker.test.ts     | 18 ++++---
 .../fast-agent-integration-broker.ts          |  5 +-
 7 files changed, 20 insertions(+), 171 deletions(-)

diff --git a/apps/docs/providers/source-control/github.mdx b/apps/docs/providers/source-control/github.mdx
index afab63af4..990832c6c 100644
--- a/apps/docs/providers/source-control/github.mdx
+++ b/apps/docs/providers/source-control/github.mdx
@@ -85,23 +85,6 @@ Grant these repository permissions:
 - **Pull requests**: Read and write
 - **Workflows**: Read and write
 
-Fast mode needs at least **Actions: Read-only** to inspect workflow runs, jobs,
-step conclusions, and available failure logs. The Roomote manifest requests
-**Read and write** because other Roomote workflows can also manage Actions; Fast
-mode still accesses GitHub through a read-only tool policy.
-
-If the GitHub App or installation predates the Actions permission, an app owner
-must add **Actions: Read-only** or **Read and write** under **Permissions &
-events**. GitHub then requires an installation owner to approve the updated
-permission. In Roomote, open **Settings > Source control** and select **Approve
-GitHub access**, then **Refresh GitHub**. A full reinstall is normally not
-required, but uninstall and reinstall the app if GitHub does not offer the
-permission approval for the existing installation.
-
-GitHub may remove logs after the repository's retention period or deny them for
-an installation that lacks access. In those cases Roomote can report run, job,
-and step metadata, but it will not claim to have inspected unavailable logs.
-
 Subscribe to these events:
 
 - **Check run**
diff --git a/apps/web/src/components/settings/SourceControl.test.tsx b/apps/web/src/components/settings/SourceControl.test.tsx
index 2ceabd966..17413f8f4 100644
--- a/apps/web/src/components/settings/SourceControl.test.tsx
+++ b/apps/web/src/components/settings/SourceControl.test.tsx
@@ -8,9 +8,7 @@ import { fireEvent, render, screen } from '@testing-library/react';
 import { toast } from 'sonner';
 
 const state = vi.hoisted(() => ({
-  gitHubInstallations: [
-    { id: 'gh-1', permissions: { actions: 'write' } },
-  ] as Array<{ id: string; permissions: Record<string, string> }>,
+  gitHubInstallations: [{ id: 'gh-1' }],
   gitHubRepositories: [
     {
       id: 'repo-1',
@@ -356,9 +354,7 @@ describe('SourceControl settings', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     state.searchParams = '';
-    state.gitHubInstallations = [
-      { id: 'gh-1', permissions: { actions: 'write' } },
-    ];
+    state.gitHubInstallations = [{ id: 'gh-1' }];
     state.gitHubRepositories = [
       {
         id: 'repo-1',
@@ -566,27 +562,6 @@ describe('SourceControl settings', () => {
     );
   });
 
-  it('guides older GitHub installations through Actions permission approval', () => {
-    state.gitHubInstallations = [
-      { id: 'gh-1', permissions: { contents: 'write' } },
-    ];
-
-    render(<SourceControl />);
-
-    expect(
-      screen.getByText(/This installation cannot read GitHub Actions runs/),
-    ).toBeInTheDocument();
-    expect(
-      screen.getByRole('button', { name: 'Approve GitHub access' }),
-    ).toBeInTheDocument();
-    expect(
-      screen.getByRole('link', { name: 'Review the setup steps' }),
-    ).toHaveAttribute(
-      'href',
-      'https://docs.roomote.dev/providers/source-control/github#permissions-and-events',
-    );
-  });
-
   it('syncs GitLab repositories from the source control section', () => {
     render(<SourceControl />);
 
diff --git a/apps/web/src/components/settings/SourceControl.tsx b/apps/web/src/components/settings/SourceControl.tsx
index 8a4e7fc29..938403ca4 100644
--- a/apps/web/src/components/settings/SourceControl.tsx
+++ b/apps/web/src/components/settings/SourceControl.tsx
@@ -58,15 +58,6 @@ import { SourceControlConfigForm } from './SourceControlConfigForm';
 
 const INITIAL_REPO_COUNT = 100;
 
-function hasGitHubActionsReadPermission(permissions: unknown): boolean {
-  if (!permissions || typeof permissions !== 'object') {
-    return false;
-  }
-
-  const actions = (permissions as Record<string, unknown>).actions;
-  return actions === 'read' || actions === 'write';
-}
-
 type Repository = {
   id: string;
   fullName: string;
@@ -252,13 +243,6 @@ export function SourceControl() {
     gitHubRepositories.isPending ||
     sourceControlConfigStatus.isPending;
   const gitHubIsConnected = (gitHubInstallations.data?.length ?? 0) > 0;
-  const gitHubNeedsActionsPermission =
-    gitHubIsConnected &&
-    (gitHubInstallations.data?.some(
-      (installation) =>
-        !hasGitHubActionsReadPermission(installation.permissions),
-    ) ??
-      false);
   const gitHubIsConfigured = isProviderConfigured(
     sourceControlConfigStatus.data,
     'github',
@@ -383,11 +367,7 @@ export function SourceControl() {
               disabled={enableGitHubApp.isPending}
             >
               {gitHubIsConnected ? <Pencil /> : <Plug />}
-              {gitHubNeedsActionsPermission
-                ? 'Approve GitHub access'
-                : gitHubIsConnected
-                  ? 'Update GitHub'
-                  : 'Connect GitHub'}
+              {gitHubIsConnected ? 'Update GitHub' : 'Connect GitHub'}
             </Button>
             {gitHubIsConnected ? (
               <Button
@@ -433,31 +413,11 @@ export function SourceControl() {
         ? 'Missing a repo here? Update GitHub, then refresh to make it available here.'
         : undefined,
       configForm: isAdmin ? (
-        <div className="space-y-4">
-          {gitHubNeedsActionsPermission ? (
-            <Alert variant="warning">
-              <AlertDescription>
-                This installation cannot read GitHub Actions runs. First grant
-                the GitHub App <strong>Actions: Read-only</strong> or higher,
-                then use <strong>Approve GitHub access</strong> to approve the
-                updated permission. Refresh GitHub after approval.{' '}
-                <Link
-                  href="https://docs.roomote.dev/providers/source-control/github#permissions-and-events"
-                  target="_blank"
-                  className="font-medium underline underline-offset-4"
-                >
-                  Review the setup steps
-                </Link>
-                .
-              </AlertDescription>
-            </Alert>
-          ) : null}
-          <SourceControlConfigForm
-            provider="github"
-            configStatus={sourceControlConfigStatus.data}
-            saveSuccessMessage="GitHub App credentials saved."
-          />
-        </div>
+        <SourceControlConfigForm
+          provider="github"
+          configStatus={sourceControlConfigStatus.data}
+          saveSuccessMessage="GitHub App credentials saved."
+        />
       ) : null,
       githubSetup: isAdmin ? (
         <GitHubAppSettingsSetup redirectTarget={redirectTarget} />
diff --git a/apps/web/src/trpc/commands/github/mutations.test.ts b/apps/web/src/trpc/commands/github/mutations.test.ts
index 0a5247389..77da75fc2 100644
--- a/apps/web/src/trpc/commands/github/mutations.test.ts
+++ b/apps/web/src/trpc/commands/github/mutations.test.ts
@@ -5,7 +5,6 @@ const {
   mockDbTransaction,
   mockEnvState,
   mockFetch,
-  mockFindGitHubInstallations,
   mockResolveDeploymentEnvVar,
   mockResolvePendingGitHubInstallations,
   mockUpsertDeploymentEnvironmentVariables,
@@ -20,7 +19,6 @@ const {
     R_GITHUB_CLIENT_SECRET: 'client-secret',
   },
   mockFetch: vi.fn(),
-  mockFindGitHubInstallations: vi.fn(),
   mockResolveDeploymentEnvVar: vi.fn(),
   mockResolvePendingGitHubInstallations: vi.fn(),
   mockUpsertDeploymentEnvironmentVariables: vi.fn(),
@@ -48,7 +46,7 @@ vi.mock('@roomote/db/server', () => ({
     transaction: mockDbTransaction,
     query: {
       githubInstallations: {
-        findMany: mockFindGitHubInstallations,
+        findMany: vi.fn(),
       },
     },
   },
@@ -83,7 +81,6 @@ vi.mock('@roomote/sdk/server/automation-recommendations', () => ({
 }));
 
 import {
-  enableGitHubAppCommand,
   finishCreateGitHubAppManifestCommand,
   resolvePendingGitHubInstallationsCommand,
   startAuthenticateGitHubAccountCommand,
@@ -124,7 +121,6 @@ describe('GitHub App manifest commands', () => {
     mockDbTransaction.mockImplementation(async (callback) =>
       callback({ kind: 'tx' }),
     );
-    mockFindGitHubInstallations.mockResolvedValue([]);
     mockResolveDeploymentEnvVar.mockResolvedValue('created-roomote-app');
   });
 
@@ -223,25 +219,6 @@ describe('GitHub App manifest commands', () => {
     });
   });
 
-  it('routes older organization installations to their permission approval settings', async () => {
-    mockFindGitHubInstallations
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce([
-        {
-          installationId: 12345,
-          accountLogin: 'roomote-org',
-          accountType: 'Organization',
-          permissions: { contents: 'write' },
-        },
-      ]);
-
-    await expect(enableGitHubAppCommand(buildMockAuth())).resolves.toEqual({
-      success: true,
-      mode: 'redirect',
-      url: 'https://github.com/organizations/roomote-org/settings/installations/12345',
-    });
-  });
-
   it('prefers R_PUBLIC_URL for manifest callbacks, webhooks, and name when R_APP_URL is loopback', async () => {
     mockEnvState.R_APP_URL = 'http://127.0.0.1:13000';
     mockEnvState.R_PUBLIC_URL = 'https://customer.example';
diff --git a/apps/web/src/trpc/commands/github/mutations.ts b/apps/web/src/trpc/commands/github/mutations.ts
index 9ada815d6..3f054a767 100644
--- a/apps/web/src/trpc/commands/github/mutations.ts
+++ b/apps/web/src/trpc/commands/github/mutations.ts
@@ -45,27 +45,6 @@ type CloudActionResult =
   | { success: true; redirectUrl: string }
   | { success: false; error: string };
 
-function hasGitHubActionsReadPermission(permissions: unknown): boolean {
-  if (!permissions || typeof permissions !== 'object') {
-    return false;
-  }
-
-  const actions = (permissions as Record<string, unknown>).actions;
-  return actions === 'read' || actions === 'write';
-}
-
-function getGitHubInstallationSettingsUrl(installation: {
-  installationId: number;
-  accountLogin: string;
-  accountType: string;
-}): string {
-  if (installation.accountType === 'Organization') {
-    return `https://github.com/organizations/${encodeURIComponent(installation.accountLogin)}/settings/installations/${installation.installationId}`;
-  }
-
-  return `https://github.com/settings/installations/${installation.installationId}`;
-}
-
 const GITHUB_APP_DEFAULT_EVENTS = [
   'check_run',
   'check_suite',
@@ -699,30 +678,6 @@ export async function enableGitHubAppCommand(
       }
     }
 
-    const activeInstallations = await db.query.githubInstallations.findMany({
-      where: isNull(githubInstallations.suspendedAt),
-      columns: {
-        installationId: true,
-        accountLogin: true,
-        accountType: true,
-        permissions: true,
-      },
-    });
-    const installationMissingActionsPermission = activeInstallations.find(
-      (installation) =>
-        !hasGitHubActionsReadPermission(installation.permissions),
-    );
-
-    if (installationMissingActionsPermission) {
-      return {
-        success: true,
-        mode: 'redirect',
-        url: getGitHubInstallationSettingsUrl(
-          installationMissingActionsPermission,
-        ),
-      };
-    }
-
     const installResult = await startCreateGitHubInstallationCommand(
       auth,
       state,
diff --git a/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts b/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts
index df33f760d..225f6ac60 100644
--- a/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts
+++ b/packages/cloud-agents/src/server/fast-agent/__tests__/fast-agent-integration-broker.test.ts
@@ -90,6 +90,11 @@ describe('fast-agent integration broker', () => {
 
   it('exposes the deployment GitHub App through its read-only router MCP', async () => {
     mocks.findGithubInstallation.mockResolvedValue({ id: 42 });
+    mocks.listMcpTools.mockResolvedValue([
+      { name: 'actions_get', inputSchema: { type: 'object' } },
+      { name: 'actions_list', inputSchema: { type: 'object' } },
+      { name: 'get_job_logs', inputSchema: { type: 'object' } },
+    ]);
 
     const integrations = await listFastAgentIntegrations({
       userId: 'user-1',
@@ -99,14 +104,11 @@ describe('fast-agent integration broker', () => {
     expect(integrations.map((integration) => integration.id)).toEqual([
       'github',
     ]);
-    expect(integrations[0]).toEqual(
-      expect.objectContaining({
-        description: expect.stringContaining('GitHub Actions runs'),
-        instructions: expect.stringContaining(
-          'explicitly say that logs were not available',
-        ),
-      }),
-    );
+    expect(integrations[0]?.tools.map((tool) => tool.name)).toEqual([
+      'actions_get',
+      'actions_list',
+      'get_job_logs',
+    ]);
     expect(mocks.listMcpTools).toHaveBeenCalledWith({
       url: 'https://api.example.com/api/mcp-routing/github',
       headers: { Authorization: 'Bearer control-plane-token' },
diff --git a/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts b/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts
index c4e912139..f1fd8af59 100644
--- a/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts
+++ b/packages/cloud-agents/src/server/fast-agent/fast-agent-integration-broker.ts
@@ -53,8 +53,6 @@ type IntegrationAuditContext = BrokerContext & {
 
 const FAST_AGENT_INTEGRATION_TOOL_CACHE_TTL_MS = 5 * 60_000;
 
-const FAST_AGENT_GITHUB_INSTRUCTIONS = `For a GitHub Actions run link, use actions_get to read the workflow run, actions_list to inspect its jobs and step conclusions, and get_job_logs only when failure details require logs. Prefer failed-job logs over the full run archive; request bounded log content with failed_only=true, return_content=true, and a reasonable tail_lines value. If logs are expired, unavailable, or denied, explain what the run, job, and step metadata shows and explicitly say that logs were not available; never imply that logs or annotations were inspected unless the tool result contains them.`;
-
 type IntegrationToolCacheEntry = {
   expiresAt: number;
   tools: Promise<McpToolDefinition[]>;
@@ -180,8 +178,7 @@ export async function listFastAgentIntegrations(
       id: 'github',
       name: 'GitHub',
       description:
-        'Read repositories, code, issues, pull requests, commits, GitHub Actions runs, jobs, and failure details available to the deployment GitHub App.',
-      instructions: FAST_AGENT_GITHUB_INSTRUCTIONS,
+        'Read repositories, code, issues, pull requests, commits, and recent activity available to the deployment GitHub App.',
       disabledTools: new Set<string>(),
     });
   }