feat(selfhost): pass repo instructions to cli reviewers - #2954
Merged
JSONbored merged 1 commit intoJul 4, 2026
Conversation
Add system-append support for subscription CLI review runners so repository instructions can travel through CLI-specific system prompt channels without duplicating stdin prompt text. Thread the append field only to self-host CLI reviewer models, keep Workers provider requests unchanged, and regenerate the self-host environment reference.
JSONbored
approved these changes
Jul 4, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2954 +/- ##
=======================================
Coverage 96.05% 96.05%
=======================================
Files 259 259
Lines 28571 28594 +23
Branches 10396 10407 +11
=======================================
+ Hits 27444 27467 +23
Misses 490 490
Partials 637 637
🚀 New features to boost your workflow:
|
JSONbored
added a commit
that referenced
this pull request
Jul 11, 2026
…an interactive plan or a prompt injection (#5079) (#5080) Two compounding bugs in createClaudeCodeAi, confirmed live via two real ai_review_provider_unparseable_output events where the model explicitly refused, citing both: 1. --permission-mode plan has been passed to every claude invocation since the self-host stack's original commit. This activates the full interactive Plan-Mode workflow (explore, draft a plan, wait for ExitPlanMode approval), not just a read-only restriction -- disallowedTools already forbids every mutating/networked tool, so nothing needing that framing remains. Switched to bypassPermissions, matching the "no TTY to answer a prompt, disallowedTools is the real boundary" intent this call already has. 2. systemAppend (repo-level review instructions from .gittensory.yml) was textually prepended into the stdin prompt behind a literal "ADDITIONAL SYSTEM INSTRUCTIONS:" header. This was implemented correctly in #1471/PR #2954 via the real --append-system-prompt flag, then regressed by a later commit that moved it back to textual stdin-smuggling to keep the content out of argv/`ps aux` -- inadvertently recreating the textbook shape of a prompt-injection attack, which claude-code's own safety training correctly flags as suspicious. Now written to a file inside the same per-call isolated temp dir already used for the subprocess cwd, passed via --append-system-prompt-file: content stays out of argv AND out of the untrusted-looking stdin blob. codex is unaffected (--sandbox read-only, not --permission-mode; no CLI-native system-prompt-file equivalent, per #1471's own documented limitation -- keeps its existing textual-prepend approach).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #1471
Scope
type(scope): short summaryConventional Commit format, for examplefix(api): restore profile access checks.CONTRIBUTING.mdand does not reintroduce GitHub Pages, VitePress,site/, orCNAME.Validation
git diff --checknpm run actionlintnpm run typechecknpm run test:coveragelocally;codecov/patchrequires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.npm run test:workersnpm run build:mcpnpm run test:mcp-packnpm run ui:openapi:checknpm run ui:lintnpm run ui:typechecknpm run ui:buildnpm audit --audit-level=moderateIf any required check was skipped, explain why:
npm run test:cipassed after rebasing onto currentupstream/main; it covers the checked commands above plus the repository's generated-artifact, migration, observability, miner, REES, OpenAPI settings-parity, UI version-audit, and UI test checks.Safety
UI Evidencesection below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.UI Evidence
No visible UI layout or state change. The UI file change is the generated self-host environment reference table updating source line references.
Notes