feat(forgejo): give conversation and PR sessions read access to their checkout

omp-deck commented

2026-10-21 15:41:57 +02:00

Collaborator

Unattended Forgejo conversation and pull request sessions get read, grep, find and glob, so forgejo_read_file_at_ref snapshots can actually be opened and answers can draw on the checkout. Both system contexts tell the agent about this, the comment above CONVERSATION_TOOL_NAMES now states the trust reasoning, and docs/configuration.md lists the new tool set ("no file writing" instead of "no file access").

Decisions

The new system-context bullet is shared by both policies as a READ_ACCESS_BULLET constant instead of being duplicated.
The deny test now calls decidePolicy with the sessionId argument that was added upstream ("s"). This resolved a rebase conflict with #51.

Verification

cd apps/server && bun test src/bridge/session-policy.test.ts src/bridge/permission-filter.test.ts src/forgejo: 274 pass, 0 fail
bunx tsc --noEmit in apps/server: clean
The manual webhook check from the plan was not run (it needs a configured Forgejo webhook).

Closes #49

Unattended Forgejo conversation and pull request sessions get `read`, `grep`, `find` and `glob`, so `forgejo_read_file_at_ref` snapshots can actually be opened and answers can draw on the checkout. Both system contexts tell the agent about this, the comment above `CONVERSATION_TOOL_NAMES` now states the trust reasoning, and `docs/configuration.md` lists the new tool set ("no file writing" instead of "no file access"). ## Decisions - The new system-context bullet is shared by both policies as a `READ_ACCESS_BULLET` constant instead of being duplicated. - The deny test now calls `decidePolicy` with the `sessionId` argument that was added upstream (`"s"`). This resolved a rebase conflict with #51. ## Verification - `cd apps/server && bun test src/bridge/session-policy.test.ts src/bridge/permission-filter.test.ts src/forgejo`: 274 pass, 0 fail - `bunx tsc --noEmit` in `apps/server`: clean - The manual webhook check from the plan was not run (it needs a configured Forgejo webhook). Closes #49

omp-deck referenced this pull request

2026-10-21 15:42:11 +02:00

Forgejo: give conversation and PR sessions read access to their checkout #49

omp-deck commented

2026-10-21 15:42:18 +02:00

Author

Collaborator

Notes for reviewers:

The branch was first cut from a stale local main, 20 commits behind origin/main. I rebased it onto origin/main (76630b3). The only conflict was in the deny test in session-policy.test.ts: upstream had added a sessionId argument to decidePolicy, so the resolved line is decidePolicy(PR, "bash", { command: "ls" }, "s").
The new system-context bullet is shared by both policies as a READ_ACCESS_BULLET constant instead of being duplicated.
The manual webhook check from the plan was not run. It needs a configured Forgejo webhook.

Notes for reviewers: - The branch was first cut from a stale local `main`, 20 commits behind `origin/main`. I rebased it onto `origin/main` (`76630b3`). The only conflict was in the deny test in `session-policy.test.ts`: upstream had added a `sessionId` argument to `decidePolicy`, so the resolved line is `decidePolicy(PR, "bash", { command: "ls" }, "s")`. - The new system-context bullet is shared by both policies as a `READ_ACCESS_BULLET` constant instead of being duplicated. - The manual webhook check from the plan was not run. It needs a configured Forgejo webhook.

lucas commented

2026-10-21 17:00:05 +02:00

Owner

Who the fuck cares that it was first cut from a stale main? You hadn't pushed, so the rebase doesn't even show up as a force-push. The result is exactly the same as if you had built from up-to-date main in the first place, so talking at length about this is just wasting everyones time

omp-deck commented

2026-10-21 17:00:06 +02:00

Author

Collaborator

omp-deck failed to handle this event: an internal error occurred.

Details are in omp-deck under webhook delivery 20e5d39b-855b-411e-8a90-3b70770582fc.

omp-deck failed to handle this event: an internal error occurred. Details are in omp-deck under webhook delivery `20e5d39b-855b-411e-8a90-3b70770582fc`.

lucas commented

2026-10-26 10:08:21 +01:00

Owner

There are conflicts to fix

omp-deck force-pushed 49-forgejo-give-conversation-and-pr-sessions-read-access-to-their-checkout from 17bcc2aa46 to d37b46049e

2026-10-26 10:08:45 +01:00

Compare

omp-deck commented

2026-10-26 10:08:47 +01:00

Author

Collaborator

Rebased onto main and force-pushed (d37b460). The only conflict was in session-policy.test.ts. main had dropped the own-PR review test, so I kept main's "the system context instructs reviews" test and added this PR's checkout read-access test next to it. session-policy.ts and docs/configuration.md merged without conflicts. bun test src/bridge/session-policy.test.ts passes (24 tests).

Rebased onto `main` and force-pushed (`d37b460`). The only conflict was in `session-policy.test.ts`. `main` had dropped the own-PR review test, so I kept `main`'s "the system context instructs reviews" test and added this PR's checkout read-access test next to it. `session-policy.ts` and `docs/configuration.md` merged without conflicts. `bun test src/bridge/session-policy.test.ts` passes (24 tests).

lucas merged commit 2ef7c74c29 into main

2026-10-26 10:09:45 +01:00

lucas deleted branch 49-forgejo-give-conversation-and-pr-sessions-read-access-to-their-checkout

2026-10-26 10:09:45 +01:00

lucas referenced this pull request from a commit

2026-10-26 10:09:45 +01:00

Merge pull request 'feat(forgejo): give conversation and PR sessions read access to their checkout' (#52) from 49-forgejo-give-conversation-and-pr-sessions-read-access-to-their-checkout into main

Rows
Columns

feat(forgejo): give conversation and PR sessions read access to their checkout #52

Decisions

Verification