feat(server): let idea mode file and refine Forgejo issues #244

Merged

lucas merged 1 commit from agent/issue-243-idea-mode-forgejo-issues into main

2026-11-09 15:58:54 +01:00

omp-deck commented

2026-11-09 15:32:20 +01:00

Collaborator

Idea (brainstorm) mode can now end in a filed issue.

Three Forgejo write tools stay registered in idea mode — forgejo_create_issue, forgejo_create_issue_comment, forgejo_update_issue_description — and every other Forgejo write tool is still removed from the tool set.

Enforcement does not rely on the tool set (that is only a visibility measure). The new apps/server/src/bridge/idea-mode-policy.ts re-decides the whole FORGEJO_MUTATING_TOOLS set per call inside PermissionFilter:

forgejo_create_issue — unrestricted (no target, no authorship question).
forgejo_create_issue_comment — issue numbers only; a pull-request number is denied.
forgejo_update_issue_description — issue numbers only, and only for issues opened by the agent's own Forgejo account.
Anything that cannot be verified (no number in the params, no repo/API/username, failing Forgejo read, unknown author) denies and names the reason, including the HTTP status so a wrong number is distinguishable from an outage.

The branch sits after the deny-rule check and before the allow-rule lookup, so an allow rule still silences the approval prompt for a permitted tool but cannot widen what idea mode permits, and a deny rule still wins. IDEA_MODE_SYSTEM_PROMPT is unchanged: the agent discovers the tools from the tool list and the deny messages carry the rules. The filesystem stays read-only.

DispatchApi.readIssue now reports the issue's author (user.login), which the authorship check needs; it is empty when the instance reports none, which denies safely.

Verification

New idea-mode-policy.test.ts (10 tests) covers every verdict incl. PR targets, foreign/empty author, 404/503 reads, missing repo or username, and non-numeric targets.
New idea-mode-bridge.test.ts pins the resulting tool set via the extracted ideaModeToolNames helper (used by both enter() and restore()).
New describe("idea mode") in permission-filter.test.ts proves prompt-on-create, allow-rule-silences-prompt, allow-rule-does-not-widen (denied unprompted), deny-rule-wins, non-permitted tool denied, and unchanged behaviour outside idea mode.
bun test in apps/server: 1274 pass, 0 fail. bun run typecheck green at the repo root.
Not exercised: the end-to-end run in a live deck against a configured Forgejo instance.

Closes: #243

Idea (brainstorm) mode can now end in a filed issue. Three Forgejo write tools stay registered in idea mode — `forgejo_create_issue`, `forgejo_create_issue_comment`, `forgejo_update_issue_description` — and every other Forgejo write tool is still removed from the tool set. Enforcement does not rely on the tool set (that is only a visibility measure). The new `apps/server/src/bridge/idea-mode-policy.ts` re-decides the whole `FORGEJO_MUTATING_TOOLS` set per call inside `PermissionFilter`: - `forgejo_create_issue` — unrestricted (no target, no authorship question). - `forgejo_create_issue_comment` — issue numbers only; a pull-request number is denied. - `forgejo_update_issue_description` — issue numbers only, and only for issues opened by the agent's own Forgejo account. - Anything that cannot be verified (no number in the params, no repo/API/username, failing Forgejo read, unknown author) denies and names the reason, including the HTTP status so a wrong number is distinguishable from an outage. The branch sits after the deny-rule check and before the allow-rule lookup, so an *allow* rule still silences the approval prompt for a permitted tool but cannot widen what idea mode permits, and a *deny* rule still wins. `IDEA_MODE_SYSTEM_PROMPT` is unchanged: the agent discovers the tools from the tool list and the deny messages carry the rules. The filesystem stays read-only. `DispatchApi.readIssue` now reports the issue's `author` (`user.login`), which the authorship check needs; it is empty when the instance reports none, which denies safely. ### Verification - New `idea-mode-policy.test.ts` (10 tests) covers every verdict incl. PR targets, foreign/empty author, 404/503 reads, missing repo or username, and non-numeric targets. - New `idea-mode-bridge.test.ts` pins the resulting tool set via the extracted `ideaModeToolNames` helper (used by both `enter()` and `restore()`). - New `describe("idea mode")` in `permission-filter.test.ts` proves prompt-on-create, allow-rule-silences-prompt, allow-rule-does-not-widen (denied unprompted), deny-rule-wins, non-permitted tool denied, and unchanged behaviour outside idea mode. - `bun test` in `apps/server`: 1274 pass, 0 fail. `bun run typecheck` green at the repo root. - Not exercised: the end-to-end run in a live deck against a configured Forgejo instance. Closes: #243

omp-deck added 1 commit

2026-11-09 15:32:20 +01:00

feat(server): let idea mode file and refine Forgejo issues 67b856a558

A brainstorm can now end in a filed issue: idea mode keeps
forgejo_create_issue, forgejo_create_issue_comment and
forgejo_update_issue_description, and drops every other Forgejo write
tool from the tool set as before.

The two targeted tools are re-checked per call against the live issue
rather than trusting the tool set: a pull-request number is denied, a
description may only be rewritten on an issue the agent's own account
opened, and any target that cannot be verified denies with the reason.
The check sits above the allow-rule lookup, so an allow rule only
silences the approval prompt while a deny rule still wins.

readIssue now carries the issue's author, which the authorship check
needs.

Co-Authored-By: Claude Opus 5 via omp-deck