The reviewer runs an opencode agent with `bash: "*": allow` over a checkout of the PR author's branch, and the pod holds a Gitea Write credential. Those two facts had no wall between them. Security - _build_env now allow-lists the subprocess environment instead of inheriting it, so PRAGENT_BOT_TOKEN and WEBHOOK_SECRET never reach the agent. This was the live hole: a PR body or an AGENTS.md could ask the agent to `curl` the token out, and it had both the value and the tool. - sanitize_workdir deletes author-controlled agent-instruction files from the checkout before opencode starts (AGENTS.md at any depth, CLAUDE.md, .cursorrules, a repo opencode.json/.opencode, copilot-instructions.md). opencode loads nested AGENTS.md as instructions, so a PR could otherwise ship its own system prompt. They are still reviewed, as data. - The brief fences PR title/body and diff in --- UNTRUSTED --- markers under a trust-boundary preamble; the pragent agent, the three lens subagents and the review-methodology skill now treat injection attempts as a critical finding to report rather than an instruction to obey. - .pr-review.json is read from the PR's base branch, not the head sha. Its `instructions` field is spliced into the reviewer's prompt, so head-ref reading let any author rewrite the reviewer's rules. Fields are length-capped. - Untar rejects escaping symlinks, parent traversal, and writes through a planted symlink (tar-slip). - The image runs as uid 10001 instead of root. Robustness - Bounded review concurrency (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2). Each review forks an opencode process; a thread per delivery was a fork bomb on a burst of labels or Gitea retries. - An in-flight (repo, index, sha) claim closes the check-then-act race in the sha-marker dedupe, where two deliveries a second apart both read "not yet reviewed" and both posted. - Request bodies are capped before being read into memory. Correctness - parse_diff_anchors counts a whitespace-stripped blank context line. Skipping it desynced the new-line counter for the rest of the hunk and silently misplaced every later inline comment in that file. - post_inline_review's body-only fallback folds the anchored findings into the body. It previously posted a summary saying "N inline comment(s) below" with no comments and no findings — losing them all on the one path that matters. - fetch_pr_diff's files-endpoint fallback emits real a// b/ prefixes (so changed_files and the anchor parser work on it) and reports both HTTP statuses in its error instead of the same one twice. - The CI workflow template pins PRAGENT_ENGINE=ollama; review_pr defaults to opencode, which does not exist on a Gitea Actions runner. Tests: 68 -> 101, covering each of the above. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN
pragent pilot — AI Review bot
A minimal AI code-review bot for Gitea, running as a CI step on the existing
act-runner. This is the pilot — a small, self-contained reviewer that
predates the full pragent framework (whose design lives in
docs/plans/2026-08-04-pragent-design.md). The framework will later absorb
this; until then, this is what runs.
How it works
- You add
pragent-botto a repo and commit.gitea/workflows/ai-review.yml. - On a PR, you add the
AI-REVIEWlabel. - Gitea Actions runs the workflow on the
act-runner; it fetches the PR diff, asksglm-5.2:cloud(on-network via the headroom proxy) to review it, and posts the findings back as a PR review authored bypragent-bot. - Remove the label to stop re-reviews on further pushes.
Fail-open: the job always exits 0 and never blocks CI. Errors become a short "review failed" comment.
Onboard a repo (3 steps)
1. Add pragent-bot as collaborator
Repo → Settings → Collaborators → Add → pragent-bot → permission Write.
(Write is required to post reviews/comments.)
Or via API (with an admin/owner token):
curl -X PUT -H "Authorization: token $OWNER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"permission":"write"}' \
"http://100.74.17.70:30000/api/v1/repos/OWNER/REPO/collaborators/pragent-bot"
2. Add the PRAGENT_BOT_TOKEN secret
Repo → Settings → Actions → Secrets → New secret → name PRAGENT_BOT_TOKEN,
value = the bot's access token (ask the platform admin; stored mode-600 at
~/.claude/.pragent-bot-token on the admin host).
3. Commit the workflow
Copy pilot/workflow-template.yml into the target repo as
.gitea/workflows/ai-review.yml and commit it. That's it.
Use it
Open a PR (or push to an open one), add the AI-REVIEW label. The review
appears within ~30–90s depending on diff size and model latency.
What's intentionally NOT in the pilot
Deferred to the full framework (by design, see the design doc):
- Attention tiering (trivial/lite/full/oversized) and per-tier cost control.
- Multiple analyzer fan-out over a shared cached prompt prefix.
- Prior-comment synthesis (so each push re-posts; the latest review is tagged with the head SHA so it's easy to spot).
- Inline line comments and status checks.
pragent explain/replay/ analytics JSONL.- A second forge (GitLab) and the provider matrix.
Pieces
| File | Role |
|---|---|
pilot/ai_review.py |
The reviewer script (stdlib only). Single source of truth — fetched at runtime by each repo's workflow. |
pilot/workflow-template.yml |
The Gitea Action consumers copy into .gitea/workflows/ai-review.yml. |
tests/pilot/test_ai_review.py |
Unit tests for the pure helpers (no network). |
Run the tests
cd ~/Projects/pragent
PYTHONPATH=pilot python3 -m pytest tests/pilot/ # if pytest available
# or, without pytest:
python3 - <<'PY'
import os, sys, importlib.util
sys.path.insert(0, os.path.abspath("pilot"))
import ai_review # noqa: F401
spec = importlib.util.spec_from_file_location("t", "tests/pilot/test_ai_review.py")
m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)
fails = 0
for n in sorted(x for x in dir(m) if x.startswith("test_")):
try: getattr(m, n)(); print("PASS", n)
except Exception as e: fails += 1; print("FAIL", n, e)
print("failed:", fails)
PY
Configuration knobs (env in the workflow)
| Env | Default | Purpose |
|---|---|---|
OLLAMA_MODEL |
glm-5.2:cloud |
Model id passed to the headroom proxy. |
OLLAMA_MAX_TOKENS |
6000 |
Output token cap. |
DIFF_MAX_CHARS |
150000 |
Diff truncation cap (with a noted truncation marker). |
OLLAMA_URL |
http://100.74.17.70:8789 |
headroom proxy (tailnet). If the act-runner can't reach the tailnet IP, expose 8789 as an in-cluster Service+Endpoints and set this to the cluster DNS name. |