Files
pragent/pilot
Marcos 8c491a7626 harden(pilot): contain hostile PR content, bound the webhook, fix anchoring
The reviewer runs an opencode agent with `bash: "*": allow` over a checkout of
the PR author's branch, and the pod holds a Gitea Write credential. Those two
facts had no wall between them.

Security
- _build_env now allow-lists the subprocess environment instead of inheriting
  it, so PRAGENT_BOT_TOKEN and WEBHOOK_SECRET never reach the agent. This was
  the live hole: a PR body or an AGENTS.md could ask the agent to `curl` the
  token out, and it had both the value and the tool.
- sanitize_workdir deletes author-controlled agent-instruction files from the
  checkout before opencode starts (AGENTS.md at any depth, CLAUDE.md,
  .cursorrules, a repo opencode.json/.opencode, copilot-instructions.md).
  opencode loads nested AGENTS.md as instructions, so a PR could otherwise ship
  its own system prompt. They are still reviewed, as data.
- The brief fences PR title/body and diff in --- UNTRUSTED --- markers under a
  trust-boundary preamble; the pragent agent, the three lens subagents and the
  review-methodology skill now treat injection attempts as a critical finding
  to report rather than an instruction to obey.
- .pr-review.json is read from the PR's base branch, not the head sha. Its
  `instructions` field is spliced into the reviewer's prompt, so head-ref
  reading let any author rewrite the reviewer's rules. Fields are length-capped.
- Untar rejects escaping symlinks, parent traversal, and writes through a
  planted symlink (tar-slip).
- The image runs as uid 10001 instead of root.

Robustness
- Bounded review concurrency (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2). Each
  review forks an opencode process; a thread per delivery was a fork bomb on a
  burst of labels or Gitea retries.
- An in-flight (repo, index, sha) claim closes the check-then-act race in the
  sha-marker dedupe, where two deliveries a second apart both read "not yet
  reviewed" and both posted.
- Request bodies are capped before being read into memory.

Correctness
- parse_diff_anchors counts a whitespace-stripped blank context line. Skipping
  it desynced the new-line counter for the rest of the hunk and silently
  misplaced every later inline comment in that file.
- post_inline_review's body-only fallback folds the anchored findings into the
  body. It previously posted a summary saying "N inline comment(s) below" with
  no comments and no findings — losing them all on the one path that matters.
- fetch_pr_diff's files-endpoint fallback emits real a// b/ prefixes (so
  changed_files and the anchor parser work on it) and reports both HTTP statuses
  in its error instead of the same one twice.
- The CI workflow template pins PRAGENT_ENGINE=ollama; review_pr defaults to
  opencode, which does not exist on a Gitea Actions runner.

Tests: 68 -> 101, covering each of the above.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN
2026-08-18 04:44:44 +00:00
..

pragent pilot — AI Review bot

A minimal AI code-review bot for Gitea, running as a CI step on the existing act-runner. This is the pilot — a small, self-contained reviewer that predates the full pragent framework (whose design lives in docs/plans/2026-08-04-pragent-design.md). The framework will later absorb this; until then, this is what runs.

How it works

  1. You add pragent-bot to a repo and commit .gitea/workflows/ai-review.yml.
  2. On a PR, you add the AI-REVIEW label.
  3. Gitea Actions runs the workflow on the act-runner; it fetches the PR diff, asks glm-5.2:cloud (on-network via the headroom proxy) to review it, and posts the findings back as a PR review authored by pragent-bot.
  4. Remove the label to stop re-reviews on further pushes.

Fail-open: the job always exits 0 and never blocks CI. Errors become a short "review failed" comment.

Onboard a repo (3 steps)

1. Add pragent-bot as collaborator

Repo → Settings → Collaborators → Add → pragent-bot → permission Write. (Write is required to post reviews/comments.)

Or via API (with an admin/owner token):

curl -X PUT -H "Authorization: token $OWNER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"permission":"write"}' \
  "http://100.74.17.70:30000/api/v1/repos/OWNER/REPO/collaborators/pragent-bot"

2. Add the PRAGENT_BOT_TOKEN secret

Repo → Settings → Actions → Secrets → New secret → name PRAGENT_BOT_TOKEN, value = the bot's access token (ask the platform admin; stored mode-600 at ~/.claude/.pragent-bot-token on the admin host).

3. Commit the workflow

Copy pilot/workflow-template.yml into the target repo as .gitea/workflows/ai-review.yml and commit it. That's it.

Use it

Open a PR (or push to an open one), add the AI-REVIEW label. The review appears within ~3090s depending on diff size and model latency.

What's intentionally NOT in the pilot

Deferred to the full framework (by design, see the design doc):

  • Attention tiering (trivial/lite/full/oversized) and per-tier cost control.
  • Multiple analyzer fan-out over a shared cached prompt prefix.
  • Prior-comment synthesis (so each push re-posts; the latest review is tagged with the head SHA so it's easy to spot).
  • Inline line comments and status checks.
  • pragent explain / replay / analytics JSONL.
  • A second forge (GitLab) and the provider matrix.

Pieces

File Role
pilot/ai_review.py The reviewer script (stdlib only). Single source of truth — fetched at runtime by each repo's workflow.
pilot/workflow-template.yml The Gitea Action consumers copy into .gitea/workflows/ai-review.yml.
tests/pilot/test_ai_review.py Unit tests for the pure helpers (no network).

Run the tests

cd ~/Projects/pragent
PYTHONPATH=pilot python3 -m pytest tests/pilot/    # if pytest available
# or, without pytest:
python3 - <<'PY'
import os, sys, importlib.util
sys.path.insert(0, os.path.abspath("pilot"))
import ai_review  # noqa: F401
spec = importlib.util.spec_from_file_location("t", "tests/pilot/test_ai_review.py")
m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)
fails = 0
for n in sorted(x for x in dir(m) if x.startswith("test_")):
    try: getattr(m, n)(); print("PASS", n)
    except Exception as e: fails += 1; print("FAIL", n, e)
print("failed:", fails)
PY

Configuration knobs (env in the workflow)

Env Default Purpose
OLLAMA_MODEL glm-5.2:cloud Model id passed to the headroom proxy.
OLLAMA_MAX_TOKENS 6000 Output token cap.
DIFF_MAX_CHARS 150000 Diff truncation cap (with a noted truncation marker).
OLLAMA_URL http://100.74.17.70:8789 headroom proxy (tailnet). If the act-runner can't reach the tailnet IP, expose 8789 as an in-cluster Service+Endpoints and set this to the cluster DNS name.