[Follow-up] Update the chatgpt-codex-connector codebase to add (PR #1387)

[stranske]

Fix .agents/** exclusion: enforce connector filtering and per-comment dismissal

Why

PR #1387 addressed issue #1385, but verification returned CONCERNS because .agents/** is not fully excluded from bot review comment generation and the dismissal workflow/script integration is incomplete. This follow-up issue closes the remaining gaps by (1) enforcing .agents/** filtering at the point where review comments are created, and (2) ensuring the reusable bot comment handler dismisses only the individual comments on ignored paths (with correct pattern matching, age filtering, and structured logging), while keeping the diff tightly scoped.

Source

• Original PR: chore(codex): bootstrap PR for issue #1385 #1387
• Parent issue: P3: Configure Copilot review to skip .agents/ ledger files #1385

Tasks

Connector Configuration

• Add .agents/** pattern to the connector's ignored_paths configuration file or settings object
• Implement filter logic in the file-selection code path that runs before review comment construction
• Apply the ignored_paths filter to exclude matching files from the review comment generation pipeline
• Write unit tests that verify .agents/** files are excluded from the file selection results

Dismissal Script Enhancement

• Replace string prefix checks with glob pattern matching using minimatch or equivalent library in bot-comment-dismiss.js
• Implement pattern matching logic that correctly handles nested paths like .agents/a/b/c.yml
• Add unit tests verifying glob patterns match nested paths under .agents/ correctly
• Add negative test cases confirming non-matching paths are not incorrectly dismissed

Per-Comment Dismissal Logic

• Modify dismissal logic to iterate through individual review comments rather than dismissing entire reviews
• Implement path filtering that checks each comment's path field against ignored_paths patterns
• Add logic to skip dismissal for comments whose paths do not match ignored patterns
• Write integration tests for mixed-path reviews with both ignored and non-ignored file comments

Structured Logging

• Add structured logging for each dismissed review comment by invoking formatDismissLog() for every dismissal
• Ensure the log includes bot name and file path for each dismissed comment

Scope Cleanup

• Identify and revert changes related to verify-compare evaluation logic modifications
• Remove changes related to chain depth tracking functionality additions
• Revert ledger validation caching implementation changes
• Remove dependency version bumps unrelated to the connector filtering feature

Deferred Tasks (Requires Human)

The following tasks require modification of protected workflow files and must be completed by a maintainer with appropriate permissions:

• MANUAL: Remove inline dismissal code blocks from .github/workflows/agents-bot-comment-handler.yml
• MANUAL: Add a workflow step that invokes bot-comment-dismiss.js script using node
• MANUAL: Pass maxAgeSeconds as an explicit argument or environment variable to the dismissal script
• MANUAL: Configure the script invocation to target only individual review comments on ignored paths

Implementation guide for workflow changes:

# In .github/workflows/agents-bot-comment-handler.yml
# Replace inline dismissal blocks with:
- name: Dismiss ignored path comments
  run: |
    node .github/scripts/bot-comment-dismiss.js \
      --maxAgeSeconds=${{ inputs.maxAgeSeconds }} \
      --ignoredPaths=".agents/**" \
      --pr=${{ github.event.pull_request.number }}

Acceptance Criteria

Connector Filtering

• The connector's ignored-paths configuration includes an entry that matches all files under .agents/ (e.g., .agents/** or equivalent supported pattern)
• The filter is applied in the code path that selects files for review comment generation (i.e., before any review comment is constructed/posted)
• Given an input file list containing .agents/issue-test-ledger.yml and src/app.ts, the connector's file-selection logic returns src/app.ts and excludes .agents/issue-test-ledger.yml

Script Integration

• The script .github/scripts/bot-comment-dismiss.js accepts maxAgeSeconds as an explicit input argument
• When maxAgeSeconds is provided, the dismissal logic only dismisses individual review comments whose created_at timestamp is newer than now - maxAgeSeconds
• Older comments are left unchanged when maxAgeSeconds filtering is active

Pattern Matching

• Ignored-path matching supports patterns that match nested paths under .agents/ (e.g., .agents/** matches .agents/a/b/c.yml)
• Pattern matching does not rely on simple prefix-only string checks
• Unit tests verify that .agents/nested/deep/file.yml matches .agents/** pattern
• Unit tests verify that src/agents/file.ts does NOT match .agents/** pattern

Per-Comment Dismissal

• For a mixed-path GitHub review containing at least two review comments—one on an ignored path .agents/issue-test-ledger.yml and one on a non-ignored path src/app.ts—the script dismisses only the ignored-path comment
• The script does not dismiss the entire review object when only some comments match ignored paths
• The script does not dismiss non-ignored comments in mixed reviews

Logging

• Each dismissed review comment produces exactly one structured log entry via formatDismissLog()
• Each log entry includes (a) the bot identity and (b) the exact file path of the dismissed comment

End-to-End Validation

• Given a test PR with changes to .agents/issue-test-ledger.yml, the dismissal script successfully dismisses all matching review comments when invoked
• Querying the GitHub API for remaining non-dismissed comments on .agents/** paths returns zero results after script execution

Scope Control

• The PR modifies only the following files: (1) files under chatgpt-codex-connector/ related to ignored_paths filtering, (2) .github/scripts/bot-comment-dismiss.js, and (3) test files with names matching **/test/**/ignore* or **/test/**/dismiss*
• No other files are modified

Implementation Notes

Connector Filtering

• Add .agents/** (or equivalent supported pattern) to the connector's ignored-paths configuration
• Ensure the ignore filter is applied at the review comment generation file-selection step (not only PR context gathering)
• The filter must run before comment payloads are constructed or any review/comment creation is attempted
• Add/extend connector unit tests to stub the changed-files list and assert .agents/** is excluded while normal source files remain included

Dismissal Script Wiring

• Ensure maxAgeSeconds is explicitly accepted as a command-line argument or environment variable in the script
• The script must use it to filter eligible comment dismissals by created_at

Matching + Per-Comment Dismissal Behavior

• Implement ignored path matching using proper glob/regex matching supported by the script's dependencies (e.g., minimatch) rather than string prefix checks
• Dismiss only the individual review comment(s) whose path matches the ignored patterns
• Do not dismiss entire reviews, and do not dismiss non-ignored comments in mixed reviews
• Add tests for:
  • glob matching correctness for .agents/** (including nested paths and negative cases)
  • age window behavior via maxAgeSeconds
  • mixed-path reviews to ensure only targeted comment IDs are dismissed
  • structured logging: formatDismissLog() invoked once per dismissal and includes bot login + exact file path

Scope Control

• Revert/remove unrelated changes from the prior attempt (evaluation tweaks, caching, dependency bumps, etc.)
• The follow-up PR should only touch:
  • chatgpt-codex-connector/**
  • .github/scripts/bot-comment-dismiss.js
  • plus directly-related test files only

Background (previous attempt context)

• Reliance on guidance text in copilot-instructions.md for Copilot exclusion failed because textual guidance does not enforce configuration and does not prevent Copilot from generating review comments. Implement an enforced connector filter and/or a fallback auto-dismiss mechanism so any comments produced are removed quickly.
• Not wiring bot-comment-dismiss.js into the workflow failed because, although the script exists, it wasn't integrated into the reusable bot comment handler. Ensure the workflow calls the script and uses maxAgeSeconds to dismiss individual review comments with proper logging.

[stranske-automation-bot]

Branch codex/issue-1402 created from main.

Option 1 (Invite) is enforced on issue events. PR creation is disabled by design so you are the PR author. Codex only engages on human-authored PRs.

Please open the PR as the author so Codex can work on it:

• Compare link: https://github.com/stranske/Workflows/compare/main...codex/issue-1402?expand=1
• Suggested title: Codex bootstrap for #1402
• Suggested body (copy/paste):

<!-- meta:issue:1402 -->

@codex Your objective is to satisfy the **Acceptance Criteria** by completing each **Task** within the defined **Scope**.

## Keepalive Next Task

**This round you MUST:**
1. Implement actual code or test changes that advance at least one incomplete task toward acceptance.
2. Commit meaningful source code (.py, .yml, .js, etc.)—not just status/docs updates.
3. Mark a task checkbox complete ONLY after verifying the implementation works.
4. Focus on the FIRST unchecked task unless blocked, then move to the next.

**Guidelines:**
- Keep edits scoped to the current task rather than reshaping the entire PR.
- Use repository instructions, conventions, and tests to validate work.
- Prefer small, reviewable commits; leave clear notes when follow-up is required.
- Do NOT work on unrelated improvements until all PR tasks are complete.

**COVERAGE TASKS - SPECIAL RULES:**
If a task mentions "coverage" or a percentage target (e.g., "≥95%", "to 95%"), you MUST:
1. After adding tests, run TARGETED coverage verification to avoid timeouts:
   - For a specific script like `scripts/foo.py`, run:
     `pytest tests/scripts/test_foo.py --cov=scripts/foo --cov-report=term-missing -m "not slow"`
   - If no matching test file exists, run:
     `pytest tests/ --cov=scripts/foo --cov-report=term-missing -m "not slow" -x`
2. Find the specific script in the coverage output table
3. Verify the `Cover` column shows the target percentage or higher
4. Only mark the task complete if the actual coverage meets the target
5. If coverage is below target, add more tests until it meets the target

IMPORTANT: Always use `-m "not slow"` to skip slow integration tests that may timeout.
IMPORTANT: Use targeted `--cov=scripts/specific_module` instead of `--cov=scripts` for faster feedback.

A coverage task is NOT complete just because you added tests. It is complete ONLY when the coverage command output confirms the target is met.

**The Tasks and Acceptance Criteria are provided in the appendix below.** Work through them in order.

<!-- 
  DO NOT ADD TASK CONTENT BELOW THIS LINE
  
  Task content is dynamically injected from the PR body via the `appendix` input.
  This template file should only contain instructions, not PR-specific tasks.
  
  If you see task content in this file, it was incorrectly committed and should
  be removed. The guard script will flag this as an error.
-->

[stranske-keepalive]

🤖 Auto-pilot step $((STEP_COUNT + 1)): Analyzing issue for improvements...

Running optimizer inline (not via label trigger).

[stranske-keepalive]

Issue Optimization Suggestions

Review the suggestions below. If you want the agent to apply them, add the
agents:apply-suggestions label to this issue.

Task splitting

• Update chatgpt-codex-connector to ignore the .agents/ directory when generating review comments by adding it to the connector's ignored_paths/file-filter configuration and applying that filter before any comment/review is created. (This task combines configuration changes, code implementation, and filter application logic. It should be split into discrete steps.). Suggested split: Add .agents/** pattern to the connector's ignored_paths configuration file or settings object, Implement filter logic in the file-selection code path that runs before review comment construction, Apply the ignored_paths filter to exclude matching files from the review comment generation pipeline, Write unit tests that verify .agents/** files are excluded from the file selection results.
• Refactor the reusable bot comment handler workflow to call into .github/scripts/bot-comment-dismiss.js (instead of inline dismissal code), using maxAgeSeconds to dismiss only individual review comments on ignored paths. (This task combines workflow refactoring, script integration, parameter passing, and behavioral changes. Each aspect should be a separate task.). Suggested split: Remove inline dismissal code blocks from the agents-bot-comment-handler workflow file, Add a workflow step that invokes the bot-comment-dismiss.js script using node, Pass maxAgeSeconds as an explicit argument or environment variable to the dismissal script, Configure the script invocation to target only individual review comments on ignored paths.
• Fix ignored-path matching in the dismiss_ignored job to use proper pattern matching (glob/regex as supported by the script) rather than prefix-only checks, so nested paths under .agents/ are reliably matched. (This task combines implementation of pattern matching logic, library integration, and test coverage. Should be split into implementation and verification steps.). Suggested split: Replace string prefix checks with glob pattern matching using minimatch or equivalent library, Implement pattern matching logic that correctly handles nested paths like .agents/a/b/c.yml, Add unit tests verifying glob patterns match nested paths under .agents/ correctly, Add negative test cases confirming non-matching paths are not incorrectly dismissed.
• Change dismissal behavior so mixed-path reviews are handled correctly: dismiss only the individual comments whose paths match ignored_paths, without dismissing the entire review object even if multiple comments are ignored. (This task involves significant logic changes, API interaction patterns, and test coverage. Should be broken into implementation and validation steps.). Suggested split: Modify dismissal logic to iterate through individual review comments rather than dismissing entire reviews, Implement path filtering that checks each comment's path field against ignored_paths patterns, Add logic to skip dismissal for comments whose paths do not match ignored patterns, Write integration tests for mixed-path reviews with both ignored and non-ignored file comments.
• Remove or revert unrelated PR changes (e.g., verify-compare evaluation tweaks, chain depth tracking, ledger validation caching, LangChain version bumps) so the diff only contains connector filtering + bot comment dismissal changes. (This task requires identifying multiple unrelated changes across potentially many files. Should be split by change category.). Suggested split: Identify and revert changes related to verify-compare evaluation logic modifications, Remove changes related to chain depth tracking functionality additions, Revert ledger validation caching implementation changes, Remove dependency version bumps unrelated to the connector filtering feature.

Blocked tasks

• Refactor the reusable bot comment handler workflow to call into .github/scripts/bot-comment-dismiss.js (instead of inline dismissal code), using maxAgeSeconds to dismiss only individual review comments on ignored paths. (Agent cannot modify .github/workflows/*.yml files (protected per AGENT_LIMITATIONS) | Mark this task as requiring manual implementation or assign to a user with workflow modification permissions. Agent can prepare the script changes and document the required workflow modifications.)
• Update .github/workflows/agents-bot-comment-handler.yml so dismissal is performed by running node .github/scripts/bot-comment-dismiss.js ... (Implementation Notes) (Agent cannot modify .github/workflows/*.yml files (protected per AGENT_LIMITATIONS) | Document the exact workflow changes needed in a separate implementation guide that a maintainer can apply manually.)

Objective acceptance criteria

• End-to-end validation via GitHub API: After opening a test PR that modifies .agents/issue-test-ledger.yml, within 5 minutes there are zero non-dismissed review comments visible on any .agents/** files authored by either github-copilot[bot] or chatgpt-codex-connector[bot]. (The 5-minute time window is arbitrary and may be flaky depending on GitHub Actions queue times and API rate limits. The criterion also requires manual PR creation and observation. | Replace with: 'Given a test PR with changes to .agents/issue-test-ledger.yml, the dismissal script successfully dismisses all matching review comments when invoked, as verified by querying the GitHub API for remaining non-dismissed comments on .agents/** paths and asserting the count is zero.')
• The repository diff for this follow-up change set is limited to connector filtering + bot comment dismissal workflow/script changes: only files under chatgpt-codex-connector/**, .github/workflows/agents-bot-comment-handler.yml, and .github/scripts/bot-comment-dismiss.js are modified (or, if additional files are changed, they are exclusively new/updated tests directly exercising the connector filter or dismissal script). (This criterion is subjective regarding what constitutes 'directly exercising' and allows exceptions that could expand scope indefinitely. | Replace with: 'The PR modifies only the following files: (1) files under chatgpt-codex-connector/ related to ignored_paths filtering, (2) .github/scripts/bot-comment-dismiss.js, and (3) test files with names matching **/test/**/ignore* or **/test/**/dismiss*. No other files are modified.')

Missing sections

• None

Formatting issues

• The 'Implementation Notes' section contains workflow modification instructions that the agent cannot execute (workflow files are protected). Consider moving these to a separate 'Manual Steps Required' section.
• The 'Critical Rules' section at the end appears to be meta-instructions for issue creation rather than content for the implementer. This should be removed from the issue body.
• Some acceptance criteria are extremely long (100+ words) and combine multiple testable conditions. Consider breaking the longest criteria into separate bullet points for clarity.
• The issue uses both 'review comments' and 'individual review comments' inconsistently. Standardize terminology throughout.

Notes

• This issue is well-structured with clear Why, Source, Tasks, Acceptance Criteria, and Implementation Notes sections. However, it has significant agent compatibility problems: two tasks and multiple implementation notes require modifying protected workflow files. The issue should clearly separate agent-executable tasks from manual maintainer tasks. Several tasks are too broad and combine multiple implementation steps that should be tracked separately. The acceptance criteria are generally testable but some are overly complex or time-dependent. The scope is well-defined through explicit file restrictions, though the exceptions clause could be tightened. Consider creating a companion issue for the workflow modifications that require manual intervention, allowing the agent to focus on the connector and script changes it can actually implement.

[stranske-automation-bot]

Branch codex/issue-1402 created from main.

Option 1 (Invite) is enforced on issue events. PR creation is disabled by design so you are the PR author. Codex only engages on human-authored PRs.

Please open the PR as the author so Codex can work on it:

• Compare link: https://github.com/stranske/Workflows/compare/main...codex/issue-1402?expand=1
• Suggested title: Codex bootstrap for #1402
• Suggested body (copy/paste):

<!-- meta:issue:1402 -->

@codex Your objective is to satisfy the **Acceptance Criteria** by completing each **Task** within the defined **Scope**.

## Keepalive Next Task

**This round you MUST:**
1. Implement actual code or test changes that advance at least one incomplete task toward acceptance.
2. Commit meaningful source code (.py, .yml, .js, etc.)—not just status/docs updates.
3. Mark a task checkbox complete ONLY after verifying the implementation works.
4. Focus on the FIRST unchecked task unless blocked, then move to the next.

**Guidelines:**
- Keep edits scoped to the current task rather than reshaping the entire PR.
- Use repository instructions, conventions, and tests to validate work.
- Prefer small, reviewable commits; leave clear notes when follow-up is required.
- Do NOT work on unrelated improvements until all PR tasks are complete.

**COVERAGE TASKS - SPECIAL RULES:**
If a task mentions "coverage" or a percentage target (e.g., "≥95%", "to 95%"), you MUST:
1. After adding tests, run TARGETED coverage verification to avoid timeouts:
   - For a specific script like `scripts/foo.py`, run:
     `pytest tests/scripts/test_foo.py --cov=scripts/foo --cov-report=term-missing -m "not slow"`
   - If no matching test file exists, run:
     `pytest tests/ --cov=scripts/foo --cov-report=term-missing -m "not slow" -x`
2. Find the specific script in the coverage output table
3. Verify the `Cover` column shows the target percentage or higher
4. Only mark the task complete if the actual coverage meets the target
5. If coverage is below target, add more tests until it meets the target

IMPORTANT: Always use `-m "not slow"` to skip slow integration tests that may timeout.
IMPORTANT: Use targeted `--cov=scripts/specific_module` instead of `--cov=scripts` for faster feedback.

A coverage task is NOT complete just because you added tests. It is complete ONLY when the coverage command output confirms the target is met.

**The Tasks and Acceptance Criteria are provided in the appendix below.** Work through them in order.

<!-- 
  DO NOT ADD TASK CONTENT BELOW THIS LINE
  
  Task content is dynamically injected from the PR body via the `appendix` input.
  This template file should only contain instructions, not PR-specific tasks.
  
  If you see task content in this file, it was incorrectly committed and should
  be removed. The guard script will flag this as an error.
-->

[stranske-keepalive]

🤖 Auto-pilot step $((STEP_COUNT + 1)): Applying optimization suggestions...

Running apply inline (not via label trigger).

[stranske-keepalive]

🤖 Auto-pilot step 1: Issue prepared! Assigning to agent...

Adding agent:codex label. The capability check will run automatically.

⏳ Agent will create a PR shortly.

[stranske-automation-bot]

Codex belt dispatcher queued this issue and created branch codex/issue-1402.

[stranske-automation-bot]

Branch codex/issue-1402 created from main.

Option 1 (Invite) is enforced on issue events. PR creation is disabled by design so you are the PR author. Codex only engages on human-authored PRs.

Please open the PR as the author so Codex can work on it:

• Compare link: https://github.com/stranske/Workflows/compare/main...codex/issue-1402?expand=1
• Suggested title: Codex bootstrap for #1402
• Suggested body (copy/paste):

<!-- meta:issue:1402 -->

@codex Your objective is to satisfy the **Acceptance Criteria** by completing each **Task** within the defined **Scope**.

## Keepalive Next Task

**This round you MUST:**
1. Implement actual code or test changes that advance at least one incomplete task toward acceptance.
2. Commit meaningful source code (.py, .yml, .js, etc.)—not just status/docs updates.
3. Mark a task checkbox complete ONLY after verifying the implementation works.
4. Focus on the FIRST unchecked task unless blocked, then move to the next.

**Guidelines:**
- Keep edits scoped to the current task rather than reshaping the entire PR.
- Use repository instructions, conventions, and tests to validate work.
- Prefer small, reviewable commits; leave clear notes when follow-up is required.
- Do NOT work on unrelated improvements until all PR tasks are complete.

**COVERAGE TASKS - SPECIAL RULES:**
If a task mentions "coverage" or a percentage target (e.g., "≥95%", "to 95%"), you MUST:
1. After adding tests, run TARGETED coverage verification to avoid timeouts:
   - For a specific script like `scripts/foo.py`, run:
     `pytest tests/scripts/test_foo.py --cov=scripts/foo --cov-report=term-missing -m "not slow"`
   - If no matching test file exists, run:
     `pytest tests/ --cov=scripts/foo --cov-report=term-missing -m "not slow" -x`
2. Find the specific script in the coverage output table
3. Verify the `Cover` column shows the target percentage or higher
4. Only mark the task complete if the actual coverage meets the target
5. If coverage is below target, add more tests until it meets the target

IMPORTANT: Always use `-m "not slow"` to skip slow integration tests that may timeout.
IMPORTANT: Use targeted `--cov=scripts/specific_module` instead of `--cov=scripts` for faster feedback.

A coverage task is NOT complete just because you added tests. It is complete ONLY when the coverage command output confirms the target is met.

**The Tasks and Acceptance Criteria are provided in the appendix below.** Work through them in order.

<!-- 
  DO NOT ADD TASK CONTENT BELOW THIS LINE
  
  Task content is dynamically injected from the PR body via the `appendix` input.
  This template file should only contain instructions, not PR-specific tasks.
  
  If you see task content in this file, it was incorrectly committed and should
  be removed. The guard script will flag this as an error.
-->