Skip to content
This repository was archived by the owner on Aug 6, 2026. It is now read-only.

fix(signals): pr attribution for bots#3302

Merged
joshsny merged 1 commit into from
Jul 9, 2026
Merged

fix(signals): pr attribution for bots #3302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions packages/agent/src/server/agent-server.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1980,8 +1980,22 @@ describe("AgentServer HTTP Mode", () => {
expect(s.detectedPrUrl).toBeNull();
});

it("fails closed when the run's GitHub identity cannot be resolved", async () => {
const s = setup(justNow());
it("attributes a recent PR when the identity is a GitHub App installation (gh api user unavailable)", async () => {
// Cloud runs authenticate with a GitHub App installation token, for which
// `gh api user` returns 403 → ghLogin is null. The PR is authored by the
// app bot (e.g. "app/posthog"); recency alone must carry attribution.
const s = setup(justNow(), "app/posthog");
s.fetchGhLogin = vi.fn(async () => null);
s.maybeAttachCreatedPr(payload, terminalUpdate(PR_URL));
await flush();
expect(s.posthogAPI.updateTaskRun).toHaveBeenCalledWith("t", "r", {
output: { pr_url: PR_URL, pr_urls: [PR_URL] },
});
expect(s.detectedPrUrl).toBe(PR_URL);
});

it("still rejects an old PR when the identity cannot be resolved (recency guards)", async () => {
const s = setup(longAgo, "app/posthog");
s.fetchGhLogin = vi.fn(async () => null);
s.maybeAttachCreatedPr(payload, terminalUpdate(PR_URL));
await flush();
Expand Down
9 changes: 6 additions & 3 deletions packages/agent/src/server/agent-server.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3495,10 +3495,13 @@ ${signedCommitInstructions}${prLinkInstructions}${shellEfficiencyInstructions}
return;
}

// Only attribute PRs created during this run by this run's own GitHub
// identity — not ones the agent merely viewed.
// Only attribute PRs created during this run — not ones the agent merely
// viewed. GitHub App installation tokens (all cloud runs) can't read
// `gh api user`, so ghLogin is null there; enforce the author match only when
// we resolved our own identity, otherwise the recency gate alone scopes
// attribution to PRs created during this run.
if (!wasCreatedRecently(attribution.createdAt, Date.now())) return;
if (!wasCreatedByLogin(attribution.author, ghLogin)) return;
if (ghLogin && !wasCreatedByLogin(attribution.author, ghLogin)) return;
Comment on lines 3503 to +3504

@greptile-appsgreptile-appsBotJul 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2False attribution possible when ghLogin is null and agent views a recent PR it didn't create

When ghLogin is null (all cloud/App-token runs), the author check is skipped entirely and recency alone gates attribution. If the agent encounters a PR URL in its terminal output (e.g. from gh pr view or a tool that prints a related PR) that was created by someone else within the 5-minute window, it will be attributed to this run. The existing test "does not attribute a fresh PR authored by someone else" only exercises the case where ghLogin is resolved; there's no test for ghLogin = null + prAuthor = "some-human" + prCreatedAt = justNow(). Adding that case would confirm (or surface) the current behavior for that path.


this.detectedPrUrl = prUrl;

Expand Down
Loading