The ``ttl_minutes`` is clamped to the maximum allowed TTL from configuration.
Returns workspace info including expiration time.

The ``mode`` argument controls the command allowlist.  Supported values:

* ``safe`` (default): Only allow a restricted set of commands (git, uv, pip install,
  pytest/unittest, ruff, mypy).  This prevents dangerous operations.
* ``expert``: Allows the same commands plus additional dev tools (not implemented here).

Commands that violate the allowlist will raise a ``PermissionError``.

The upstream repository must be allowed according to the configured
allowlist (via ``upstream_allowed``).  A fork will be created under the
authenticated user's account if it does not already exist.  The function
returns the fork slug (``username/repo``), the HTTPS clone URL, and
whether a new fork was created.

The repository is cloned into the ``repo`` subdirectory within the sandbox.
All operations happen inside E2B - no host filesystem access.

The repository must be in the allowlist.

This helper encapsulates the recommended cloning workflow for a fork-based
contribution flow:
1. Clone the fork into repo/
2. Add upstream remote
3. Fetch upstream
4. Checkout base branch tracking upstream

All operations happen inside E2B sandbox.
Both fork and upstream URLs must be in the allowlist.

A valid ``approval_id`` must be provided.
Only pushing to 'origin' (the fork) is allowed.
The fork must be under the configured GitHub username.

Reads `.github/pull_request_template.md` from inside the sandbox.

Executes a Python search script inside the sandbox to find matches.
Limited to a modest time budget and maximum match count.

The patch is written to a temporary file inside the sandbox and applied
using ``git apply``.  Patch limits are enforced before application.

The repository must be in the allowlist.

The repository must be in the allowlist.

Requires a valid ``approval_id``, which is consumed prior to performing
the API call.  Raises ``PermissionError`` if the approval ID is missing or
invalid.  Delegates to the underlying GitHub API implementation.

Validates that:
1. The upstream repository is in the allowlist
2. The fork owner matches the configured GitHub username
3. The PR body does not contain auto-close keywords (closes, fixes, resolves)

The server verifies that mandatory fields (summary, unified_diff, checks,
branch_plan) are present.  If ``approved`` is True, a unique approval
identifier is generated and stored.  This identifier must be provided to
tools that perform side effects (e.g., pushing commits or opening
pull requests).

The approval ID is multi-use: it can be consumed for both "push" and
"open_pr" actions, but each action can only be performed once per approval.
The approval record is only deleted when all allowed actions have been used.

The caller must provide the diff text, metadata dictionary, before and
after failure structures, and any logs to include.  A list of secrets
should be supplied to aid in redaction.

S3: Returns the zip archive as base64-encoded bytes so the client can
retrieve it directly via the MCP protocol without needing filesystem
access to the server.

Returns:
    A dictionary containing:
    - artifact_path: Local filesystem path to the zip (for debugging)
    - zip_filename: The filename of the zip archive
    - zip_base64: Base64-encoded contents of the zip file
    - size_bytes: Size of the zip file in bytes