Vlad MocanuandClaude Opus 4.6 6b0302d226 fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation ...

- Add self-mention/bot loop prevention in actor.ts (blocks actor matching bot_name)
- Switch Forgejo permission check to actor-level via getCollaboratorPermissionLevel
  with fallback to token-level repos.get() when collaborator API returns 403
- Close empty-body PR review comment trigger bypass (now returns false instead of true)
- Add platform detection cross-validation (reject PLATFORM=forgejo on github.com)
- Document URL builder defense-in-depth rationale in comment-logic.ts
- Update/add tests across 6 test files (actor, permissions, trigger, platform, mcp, m7)

Progress: 50% complete (3/6 milestones) — next: M4 test coverage review

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 12:31:12 +02:00

..

fixtures

feat: add Agent SDK support with USE_AGENT_SDK feature flag (#698)

2025-12-03 17:22:04 -08:00

modes

feat(prd-5): add dedicated claude-bot user for Forgejo

2026-02-25 20:56:55 +02:00

actor-filter.test.ts

feat: add actor-based comment filtering to GitHub data fetching (#812)

2026-01-27 07:48:10 -08:00

actor.test.ts

fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation

2026-02-26 12:31:12 +02:00

branch-cleanup.test.ts

Fix: Pass correct branch names to MCP file ops server (#279)

2025-07-15 17:10:23 -07:00

branch-template.test.ts

fix: add missing import and update tests for branch template feature (#799)

2026-01-08 07:07:54 +05:30

comment-logic.test.ts

feat: add Agent SDK support with USE_AGENT_SDK feature flag (#698)

2025-12-03 17:22:04 -08:00

create-prompt.test.ts

Revert "fix: replace deprecated :* with modern * wildcard in git permissions (#929)" (#949)

2026-02-15 14:39:25 -08:00

data-fetcher.test.ts

fix: use original body from webhook payload for TOCTOU hardening (#904)

2026-02-05 10:54:51 -08:00

data-formatter.test.ts

feat: custom branch name templates (#571)

2026-01-08 06:47:26 +05:30

e2e-prd6-m2.txt

test: add M2 E2E test marker for PR review comment trigger

2026-02-26 10:45:08 +02:00

extract-user-request.test.ts

feat: send user request as separate content block for slash command support (#785)

2026-01-02 17:57:13 -08:00

forgejo-comment-logic.test.ts

fix(prd-7): M1 architecture review — consolidate duplication, fix bugs, memoize detection

2026-02-26 12:09:02 +02:00

forgejo-data-fetcher.test.ts

fix: remove all image-downloader mocking from forgejo-data-fetcher test

2026-02-26 10:45:09 +02:00

forgejo-token.test.ts

feat(prd-1): implement M2 - Forgejo token handling

2026-02-25 16:10:00 +02:00

format-turns.test.ts

feat: add formatted output for Claude Code execution reports (#18)

2025-07-03 10:59:12 -07:00

github-file-ops-path-validation.test.ts

feat: add path validation for commit_files MCP tool (#796)

2026-01-07 10:16:31 -08:00

image-downloader.test.ts

fix: use dependency injection for image-downloader fs mocks

2026-02-26 10:45:08 +02:00

install-mcp-server.test.ts

fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation

2026-02-26 12:31:12 +02:00

integration-sanitization.test.ts

Add enhanced text sanitization (#83)

2025-05-29 16:35:50 -07:00

m7-integration.test.ts

fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation

2026-02-26 12:31:12 +02:00

mockContext.ts

feat(prd-5): add dedicated claude-bot user for Forgejo

2026-02-25 20:56:55 +02:00

parse-permissions.test.ts

Revert "Revert "feat: send additional_permissions in token exchange request (…" (#866)

2026-01-27 14:35:18 -08:00

permissions.test.ts

fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation

2026-02-26 12:31:12 +02:00

platform-detector.test.ts

fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation

2026-02-26 12:31:12 +02:00

prepare-context.test.ts

fix: commentBody may be null (#706)

2025-12-03 17:34:31 -08:00

pull-request-target.test.ts

refactor: simplify mode system by removing Mode interface and registry (#899)

2026-02-05 17:22:30 -08:00

sanitizer.test.ts

Add GitHub token redaction to comment tools (#453)

2025-08-15 13:04:52 -07:00

ssh-signing.test.ts

fix: ensure SSH signing key has trailing newline (#834)

2026-01-16 14:44:22 -08:00

trigger-validation.test.ts

fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation

2026-02-26 12:31:12 +02:00

update-claude-comment.test.ts

feat: add unified update_claude_comment tool (#98)

2025-06-02 12:15:25 -07:00

url-encoding.test.ts

Initial commit

2025-05-19 08:32:32 -07:00

validate-branch-name.test.ts

Fix command injection vulnerability in branch setup (#736)

2025-12-12 11:30:28 -08:00