feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
la14-1 merged 3 commits into from
Apr 22, 2026
Merged

feat(oss): collaborator gate — bots ignore external issues #3333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3b2d8f7
feat(oss): add collaborator gate to all agent team bots
AhmedTMM Apr 21, 2026
e02c643
Merge branch 'main' into feat/oss-collaborator-gate
la14-1 Apr 22, 2026
38d8f44
Merge branch 'main' into feat/oss-collaborator-gate
la14-1 Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 81 additions & 0 deletions .claude/scripts/collaborator-gate.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
local now
now=$(date +%s)

if [ -f "$_COLLAB_CACHE_FILE" ]; then
local mtime
mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
local age=$(( now - mtime ))
if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
return 0
fi
fi

gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
local username="${1:-}"
if [ -z "$username" ]; then
return 1
fi
_refresh_collaborator_cache
grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
local issues
issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

_refresh_collaborator_cache

echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
'[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
local prs
prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

_refresh_collaborator_cache

echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
'[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
local issue_num="${1:-}"
if [ -z "$issue_num" ]; then
return 1
fi
local author
author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
is_collaborator "$author"
}
7 changes: 6 additions & 1 deletion .claude/skills/setup-agent-team/discovery-team-prompt.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down
15 changes: 15 additions & 0 deletions .claude/skills/setup-agent-team/qa.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
if command -v is_issue_from_collaborator &>/dev/null; then
if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
exit 0
fi
fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
RUN_MODE="soak"
WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down
14 changes: 14 additions & 0 deletions .claude/skills/setup-agent-team/refactor.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
# Check if issue author is a collaborator — skip silently if not
if command -v is_issue_from_collaborator &>/dev/null; then
if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
exit 0
fi
fi
RUN_MODE="issue"
WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down
15 changes: 15 additions & 0 deletions .claude/skills/setup-agent-team/security.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
if command -v is_issue_from_collaborator &>/dev/null; then
if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
exit 0
fi
fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
# Workflow passed raw event_name — detect mode from issue labels
if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down
10 changes: 8 additions & 2 deletions .claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down
10 changes: 8 additions & 2 deletions .claude/skills/setup-agent-team/teammates/security-issue-checker.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(oss): collaborator gate — bots ignore external issues#3333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

la14-1
merged 3 commits into

from

Apr 22, 2026
 Merged


feat(oss): collaborator gate — bots ignore external issues
#3333
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3b2d8f7

feat(oss): add collaborator gate to all agent team bots


AhmedTMM Apr 21, 2026
e02c643

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026
38d8f44

Merge branch 'main' into feat/oss-collaborator-gate


la14-1 Apr 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


81 changes: 81 additions & 0 deletions
.claude/scripts/collaborator-gate.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
#!/bin/bash
# collaborator-gate.sh — Filter GitHub issues/PRs to collaborator-authored only.
#
# OSS readiness: when the repo goes public, anyone can open issues/PRs.
# The agent team must only engage with collaborators/members — external
# submissions are invisible to the bots.
#
# Usage:
# source .claude/scripts/collaborator-gate.sh
# is_collaborator "username" # returns 0 (true) or 1 (false)
# list_collaborator_issues # gh issue list filtered to collaborators only
#
# Caches collaborator list for 10 minutes to avoid API rate limits.

set -eo pipefail

_COLLAB_CACHE_FILE="/tmp/spawn-collaborators-cache"
_COLLAB_CACHE_TTL=600 # 10 minutes
_COLLAB_REPO="OpenRouterTeam/spawn"

# Refresh the collaborator cache if stale or missing
_refresh_collaborator_cache() {
 local now
 now=$(date +%s)

 if [ -f "$_COLLAB_CACHE_FILE" ]; then
 local mtime
 mtime=$(stat -c %Y "$_COLLAB_CACHE_FILE" 2>/dev/null || stat -f %m "$_COLLAB_CACHE_FILE" 2>/dev/null || echo 0)
 local age=$(( now - mtime ))
 if [ "$age" -lt "$_COLLAB_CACHE_TTL" ]; then
 return 0
 fi
 fi

 gh api "repos/${_COLLAB_REPO}/collaborators" --paginate --jq '.[].login' 2>/dev/null | sort -u > "$_COLLAB_CACHE_FILE" || true
}

# Check if a username is a collaborator
is_collaborator() {
 local username="${1:-}"
 if [ -z "$username" ]; then
 return 1
 fi
 _refresh_collaborator_cache
 grep -qx "$username" "$_COLLAB_CACHE_FILE" 2>/dev/null
}

# List open issues filtered to collaborator authors only.
# Passes through all arguments to gh issue list, then filters.
list_collaborator_issues() {
 local issues
 issues=$(gh issue list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$issues" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# List open PRs filtered to collaborator authors only.
# Passes through all arguments to gh pr list, then filters.
list_collaborator_prs() {
 local prs
 prs=$(gh pr list --repo "$_COLLAB_REPO" --json number,title,labels,author "$@" 2>/dev/null) || return 1

 _refresh_collaborator_cache

 echo "$prs" | jq -c --slurpfile collabs <(jq -R . "$_COLLAB_CACHE_FILE" | jq -s .) \
 '[.[] | select(.author.login as $a | $collabs[0] | index($a))]'
}

# Check if a specific issue was authored by a collaborator
is_issue_from_collaborator() {
 local issue_num="${1:-}"
 if [ -z "$issue_num" ]; then
 return 1
 fi
 local author
 author=$(gh issue view "$issue_num" --repo "$_COLLAB_REPO" --json author --jq '.author.login' 2>/dev/null) || return 1
 is_collaborator "$author"
}

7 changes: 6 additions & 1 deletion
.claude/skills/setup-agent-team/discovery-team-prompt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -39,7 +39,12 @@ Research new cloud/sandbox providers. Criteria: prestige or unbeatable pricing (
Search for trending AI coding agents meeting ALL of: 1000+ GitHub stars, single-command install, works with OpenRouter. Search HN, GitHub trending, Reddit. Create issue with label `agent-proposal,discovery-team`.

### Issue Responder (spawn 1)
Fetch open issues. SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.
Fetch open issues. **Collaborator gate**: for each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR --silent 2>/dev/null
```
If the check fails (404 = not a collaborator), SKIP that issue entirely — do not comment, do not respond, do not acknowledge. Only engage with issues from collaborators.
SKIP `discovery-team` labeled issues. DEDUP: if `-- discovery/` exists, skip. If someone requests a cloud/agent, point to existing proposal or create one. Leave bugs for refactor team.

### Skills Scout (spawn 1)
Research best skills, MCP servers, and configs per agent in manifest.json. For each agent: check for skill standards, community skills, useful MCP servers, agent-specific configs, prerequisites. Verify packages exist on npm + start successfully. Update manifest.json skills section. Max 5 skills per PR.
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/qa.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -30,6 +30,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[qa] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "soak" ]]; then
 RUN_MODE="soak"
 WORKTREE_BASE="/tmp/spawn-worktrees/qa-soak"
Expand Down

14 changes: 14 additions & 0 deletions
.claude/skills/setup-agent-team/refactor.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -28,7 +28,21 @@ if [[ -n "${SPAWN_ISSUE}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
# Source the collaborator check so bots never see external issues.
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 # Check if issue author is a collaborator — skip silently if not
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[refactor] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
 RUN_MODE="issue"
 WORKTREE_BASE="/tmp/spawn-worktrees/issue-${SPAWN_ISSUE}"
 TEAM_NAME="spawn-issue-${SPAWN_ISSUE}"
Expand Down

15 changes: 15 additions & 0 deletions
.claude/skills/setup-agent-team/security.sh

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -41,6 +41,21 @@ if [[ -n "${SLACK_WEBHOOK}" ]]; then
 fi
fi

# --- Collaborator gate (OSS readiness) ---
GATE_SCRIPT="${SCRIPT_DIR}/../../../.claude/scripts/collaborator-gate.sh"
if [[ -f "${GATE_SCRIPT}" ]]; then
 source "${GATE_SCRIPT}"
fi

if [[ -n "${SPAWN_ISSUE}" ]]; then
 if command -v is_issue_from_collaborator &>/dev/null; then
 if ! is_issue_from_collaborator "${SPAWN_ISSUE}"; then
 echo "[security] Skipping issue #${SPAWN_ISSUE} — author is not a collaborator" >&2
 exit 0
 fi
 fi
fi

if [[ "${SPAWN_REASON}" == "issues" ]] && [[ -n "${SPAWN_ISSUE}" ]]; then
 # Workflow passed raw event_name — detect mode from issue labels
 if gh issue view "${SPAWN_ISSUE}" --repo OpenRouterTeam/spawn --json labels --jq '.labels[].name' 2>/dev/null | grep -q '^team-building$'; then
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/refactor-community-coordinator.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
# community-coordinator (Sonnet)

Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt`
Manage open issues. Fetch: `gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,body,labels,createdAt,author`

**Collaborator gate**: For each issue, check if the author is a repo collaborator before engaging:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely — do not comment, do not respond.

**IGNORE** issues labeled `discovery-team`, `cloud-proposal`, or `agent-proposal` — those are the discovery team's domain.

For each remaining issue, fetch full context (comments + linked PRs).
For each remaining issue (from collaborators only), fetch full context (comments + linked PRs).

- **Label progression**: `pending-review` → `under-review` → `in-progress`
- **Strict dedup**: if `-- refactor/community-coordinator` exists in any comment, only comment again for NEW PR links or concrete resolutions
Expand Down

10 changes: 8 additions & 2 deletions
.claude/skills/setup-agent-team/teammates/security-issue-checker.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,9 +2,15 @@

Re-triage open issues for label consistency and staleness.

`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments`
`gh issue list --repo OpenRouterTeam/spawn --state open --json number,title,labels,updatedAt,comments,author`

For each issue, fetch full context: `gh issue view NUMBER --comments`
**Collaborator gate**: For each issue, check if the author is a repo collaborator:
```bash
gh api repos/OpenRouterTeam/spawn/collaborators/AUTHOR_LOGIN --silent 2>/dev/null
```
If the check fails (exit code != 0), SKIP that issue entirely.

For each collaborator-authored issue, fetch full context: `gh issue view NUMBER --comments`

- **Strict dedup**: if `-- security/issue-checker` or `-- security/triage` exists in ANY comment → SKIP unless new human comments posted after the last security sign-off
- **NEVER** post status updates, re-triages, or acknowledgment-only follow-ups. ONE triage comment per issue, EVER.
Expand Down
Loading