Repository navigation
feat: ask a coding agent on this computer for help, with consent - #246
autoidm-jon wants to merge 4 commits into
Conversation
Adversarial review: Codex gpt-6.1-sol, effort xhigh, three rounds
Open decisions: items 2 and 13 (how far to keep Round 3 confirmed the round-2 fixes. |
|
PR tier:
A changed diff is scored again. Job log: https://github.com/AutoIDM/pdt/actions/runs/39282021156 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2eec78f. Configure here.
| low = next((model for model in models if model.endswith("-low")), None) | ||
| if low is None: | ||
| raise AgentCommandError(f"{program} models lists no low-effort model for your account") | ||
| return [program, "-p", "--trust", "--mode", "ask", "--model", low] |
There was a problem hiding this comment.
Cursor run skips MCP and hook isolation
Medium Severity
Claude and Codex are launched so user MCP servers and hooks cannot run, but the Cursor command is only -p --trust --mode ask. Consent still says the agent cannot change files. User Cursor MCP servers and hooks can still load and take actions that --mode ask does not cover.
Reviewed by Cursor Bugbot for commit 2eec78f. Configure here.
| text = "\n\n".join([request, *(f"## {heading}\n{body}" for heading, body in context.items())]) | ||
| for value in sorted(secrets, key=len, reverse=True): | ||
| text = text.replace(value, REMOVED) | ||
| return text |
There was a problem hiding this comment.
Common env values redact the prompt
Medium Severity
Every .env value of four or more characters is substring-replaced in the request. Ordinary flag values such as true, false, none, info, and prod are treated as secrets, so much of the prompt can become <secret removed> and the agent gets a mangled question.
Reviewed by Cursor Bugbot for commit 2eec78f. Configure here.
| if not isinstance(answers, dict) or not all(isinstance(answer, bool) | ||
| for answer in answers.values()): | ||
| raise ConfigError(f"{SETTINGS}: {CONSENT_KEY} must list each coding agent with true " | ||
| "or false, for example `claude: false` on its own line under it") |
There was a problem hiding this comment.
Consent validation accepts falsy mappings
Low Severity
read_settings does settings.get(CONSENT_KEY) or {} before checking the type, so YAML false, [], or 0 for coding-agent-consent is treated as an empty mapping instead of a ConfigError. Editing the key to false to revoke consent is silently ignored and pdt prompts again.
Reviewed by Cursor Bugbot for commit 2eec78f. Configure here.
2eec78f to
31af184
Compare
|
PR tier:
A changed diff is scored again. Job log: https://github.com/AutoIDM/pdt/actions/runs/39415480829 |
Code review of
|
| # | Severity | Disposition | Finding | Action |
|---|---|---|---|---|
| N1 | nit | ⏸️ Open | Claude Code applies a Read deny rule to Grep and Glob as best effort, and Glob still returns file paths (docs). The Read(//**/.env) rule is the documented syntax, but it does not guarantee that no .env content reaches the agent. The text rule at the start of each message is the second protection. |
None in this PR. |
| N2 | nit | ⏸️ Not changed | A settings file from an earlier build of this PR, with one answer per agent, now gives coding-agent-consent must be true or false when pdt calls an agent. Ordinary pdt commands still work. No release contains the per-agent format. |
None: the format never shipped. |
Checks that passed:
- The question asks for permission to use a coding agent on this computer when the agent can help, and No is the default.
ask()checks for an installed agent, then asks for consent, then chooses the agent. No start-up path asks. falsestops every call, also when an agent choice is stored.- With no terminal, a missing or
falseconsent sends nothing. With several agents and no stored choice, pdt prints guidance and calls none.
6cf93ad to
4764391
Compare
|
PR tier:
A changed diff is scored again. Job log: https://github.com/AutoIDM/pdt/actions/runs/41847620266 |
Adds an internal
ask(request, context)that finds Claude Code, Codex, or Cursor, asks the user once per agent for consent, and runs one read-only request at low effort with.envvalues removed. Inside an agent's own session it starts no second agent;python -m pdt.coding_agentsshows what pdt finds.Note
Medium Risk
Spawns local coding agents with file read access and handles secrets via redaction and env stripping; mistakes could leak credentials or widen agent capabilities despite sandbox flags.
Overview
Adds
pdt.coding_agentswith a singleask(request, context)API that can delegate help requests to Claude Code, Codex, or Cursor when those CLIs are on PATH. The flow picks an agent (stored preference in usersettings.yml, or an interactive choice when several are allowed), prompts once per agent for consent, and runs a read-only, low-effort subprocess with agent-specific sandbox flags (e.g. no MCP/hooks for Claude, ignore user config/rules for Codex)..envsecret values (4+ chars) are stripped from the payload and matching env vars are omitted from the child process; when pdt already runs inside an agent session it prints the formatted request instead of spawning another agent.Scaffolded
AGENTS.mdnow tells agents never to read, print, or change.envor secret values, pointing users topdt validate/pdt secretsinstead.python -m pdt.coding_agentsexposes status and a manual ask path. Broad unit tests cover consent, multi-agent selection, secret handling, timeouts, and sandbox flags.Reviewed by Cursor Bugbot for commit 31af184. Bugbot is set up for automated code reviews on this repo. Configure here.