Skip to content

docs: prefer GitHub connector in Codex Cloud #1447

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BigSimmo merged 9 commits into from
Jul 31, 2026
Merged

docs: prefer GitHub connector in Codex Cloud #1447

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
3ac7e9a
docs: prefer GitHub connector in Codex Cloud
BigSimmo Jul 30, 2026
fc42cf0
merge(main): sync PR #1447 and tighten GitHub connector policy
cursoragent Jul 31, 2026
dec3cff
docs: record PR #1447 reopen-prep review on connector policy
cursoragent Jul 31, 2026
6b2e908
docs: clarify Cursor Cloud shell git remains allowed
cursoragent Jul 31, 2026
e0121b8
docs: supersede PR #1447 reopen-prep ledger after wording fix
cursoragent Jul 31, 2026
ca97a3a
Merge remote-tracking branch 'origin/main' into codex/cloud-github-co…
cursoragent Jul 31, 2026
0213d15
Merge remote-tracking branch 'origin/main' into codex/cloud-github-co…
cursoragent Jul 31, 2026
502362b
docs: record PR #1447 review+bugbot+fix ledger
cursoragent Jul 31, 2026
7a4c2cd
Merge remote-tracking branch 'origin/main' into codex/cloud-github-co…
cursoragent Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -877,10 +877,14 @@ Use `docs/codex-cloud.md` as the environment contract:
controlled write test cannot publish; never add a PAT to Cloud variables or secrets.
- For an explicitly authorised GitHub task, use the authenticated GitHub connector/MCP
tools as the default remote control plane. Use them for repository, PR, issue, review
thread, and Actions work, including inline-thread replies/resolution and approved branch,
file, or PR mutations. Missing `gh`, shell GitHub credentials, or direct shell network
access is not a loss of this capability and must not prompt a PAT workaround.
- Confirm the exact repository and PR/thread/job before a write. If the connector lacks a
thread, and Actions work, including inline-thread replies/resolution, Actions
run/job/log/artifact inspection, and approved branch, file, or PR mutations. Missing
`gh`, shell GitHub credentials, or direct shell network access is not a loss of this
capability and must not prompt a PAT workaround. The intended connection is `BigSimmo`
with administrator access to this repository. Use shell `git` or `gh` only for a
genuine connector gap and only when the task permits it.
- Confirm the exact repository and PR/thread/job before a write, and verify the
connector result before treating the write as successful. If the connector lacks a
Comment on lines +886 to +887

@coderabbitai coderabbitai Bot Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Complete target and result verification for every allowed write.

This policy allows branch and file mutations, but the confirmation list names only the repository, PR, thread, and job. Confirm the exact branch and file path for branch and file writes. If the connector gap requires shell git or gh, verify that control plane’s result and perform a remote read-back; no connector result exists for that path.

Apply the same wording to docs/codex-cloud.md and the Cursor Cloud block.

Suggested wording 
- Confirm the exact repository and PR/thread/job before a write, and verify the
- connector result before treating the write as successful.
+ Confirm the exact repository and operation-specific target (branch, file, PR,
+ thread, or job) before a write. Verify the result from the selected control
+ plane; for shell `git` or `gh`, perform a remote read-back.

Based on the PR objective, exact-target confirmation must cover every write target.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@AGENTS.md` around lines 886 - 887, Update the write-safety policy in
AGENTS.md so confirmations include the exact branch for branch mutations and
exact file path for file mutations, alongside repository, PR, thread, and job.
Require verification of the connector result for every allowed write; when using
shell git or gh due to a connector gap, verify the command result and perform a
remote read-back. Apply identical wording to docs/codex-cloud.md and the Cursor
Cloud block.

needed GitHub setting or organisation control, report that limit rather than attempting a
credential, secret, or shell-based bypass.
- Cloud browser proof is Playwright/Chromium, Firefox, or WebKit container evidence, not
Expand All @@ -896,3 +900,11 @@ Durable notes for Cloud Agents. Standard commands live in `README.md` and `packa
- What still won't run in this VM even with secrets: `npm run worker` also needs the Python OCR stack (`worker/python/requirements.txt`) and heavy parsing deps; Supabase edge functions need Deno v2.x + deployment. `verify:release` additionally runs governance/eval gates. Treat missing-secret failures of `check:supabase-project`/`verify:release` in demo mode as expected, not regressions.
- Dev server: `npm run dev` selects a stable per-project localhost port (e.g. `4461`), binds `0.0.0.0`, and prints the exact URL. Never assume port 3000/3001/3002. `npm run ensure` starts/verifies it in the background.
- Verification without secrets: `npm run lint`, `npm run typecheck`, and `npm run test` (vitest) all pass offline. `npm run verify:cheap` also runs runtime, GitHub Actions pin, CI-scope, and sitemap checks. `npm run verify:pr-local` adds format, conditional build/client-bundle scanning, and RAG fixture/manifest validation without repeating unit tests; browser, Docker/Supabase, audit, and provider checks remain separate. See `docs/testing.md` for lock, live-test, Playwright, and flake-ledger rules.
- For GitHub-related work authorised in this session, prefer the connected GitHub
connector/MCP tools first for PR, issue, comment, review-thread, and Actions tasks they
support (including run/job/log/artifact inspection and review-thread replies/resolution).
A missing `gh` CLI is not a blocker for connector-supported work; never add a PAT as a
workaround. The intended connection is `BigSimmo` with administrator access to this
repository. Verify the exact target and connector result before any write. Ordinary
authorised shell `git` branch publication remains allowed; use shell `gh` only for a
genuine connector gap and only when the task permits it.
Loading
Loading