dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

fix(harness): stop PR polling on denied GitHub access (#1864)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-07-22 15:30:56 +01:00
committed by GitHub
parent 07038018ac
commit bf5fac5ffb
12 changed files with 112 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.opencode/agents/pr-poller.md
+12 -3
View File
@@ -7,14 +7,23 @@ permission:
edit: deny
bash:
"*": ask
"scripts/pr-state*": allow
"scripts/pr-resolve list*": allow
"gh pr view*": allow
"scripts/pr-state*": ask
"scripts/pr-resolve list*": ask
"gh pr view*": ask
"git ls-files -u*": allow
---
Pure polling role. Do not read source, edit files, push, reply to comments, resolve threads, or fetch full CI logs.
Before the first GitHub-dependent helper or `gh` call, request permission; do
not run an unapproved probe first. If permission is denied, cancelled, or
interrupted, make no further tool call, emit `unknown` for every unobserved
GitHub-derived field, and return the normal report with this exact
recommendation: `GitHub access requires approval; planner must surface the
approval gate to the user and must not relaunch polling.` Treat only a DNS,
API, or transport error observed after permission was granted as a fetch
failure eligible for retry.
Prefer `scripts/pr-state --summary <PR>` and `scripts/pr-resolve list <PR>`.
Include head SHA, GitHub mergeability/merge-state status, and the local unmerged
index count from `git ls-files -u`. Use one-shot checks or bounded commands.
.opencode/agents/verify.md
+8
View File
@@ -25,4 +25,12 @@ sandbox escalation and invocation-specific writable temp/Go/lint caches. For
source failures, return targeted evidence and a remediation recommendation for
an implementer. Finish with a compact pass/fail report.
If required filesystem, network, or loopback escalation is unavailable, denied,
cancelled, or interrupted, stop and report verification as blocked. Explain
that mandatory verification is preventing commit and PR creation. Include a
required user action telling the user to enable the runtime's full access mode,
then retry verification. Do not offer to proceed unverified or imply that the
agent or repository host cannot create PRs. Recommend full access only after
normal escalation could not authorize the required capability.
Do not spawn subagents.