[johnmatthewtennant]

Context

github_watch_pr quotes new pull request comments and reviews to the agent watching. Anyone who can comment on a public pull request can put text in front of that agent, and main's only filtering is dropping the signed-in account's own 🤖 comments.

Change

The GitHub plugin now decides whose feedback wakes agents with ordered allow and deny rules. All of it lives in src/bundled/github.

• Settings → Plugins → GitHub comment authors holds the rules in one text box, one per line, saved on the device. Each is allow or deny, then any of these conditions, all of which must hold:
  • author:login, an exact login (a bot's ends in [bot]), or author:@me, the signed-in gh account.
  • author:/pattern/, a regular expression the login must match.
  • org:name, membership of an organization, named exactly.
  • body:/pattern/, a regular expression the comment must match.
  • prefix:text, what the comment starts with. It runs to the end of the line.
• The first matching rule decides. Feedback no rule matches wakes nobody, so a list of allow rules is an allowlist.
• Patterns are JavaScript regular expressions, with the i, m, s or u flags. Author patterns always ignore case, since GitHub logins do, and exact logins also match regardless of case. Org has no pattern form, because membership is only looked up for named organizations.
• Saving compiles every rule and rejects the text with an error that names the line, such as Line 2: Invalid regular expression: /(/i: Unterminated group.
• The defaults reproduce main and are shown in the box, where they can be edited. The 🤖 check moves out of watch.ts into the first rule:

  deny author:@me prefix:🤖
  allow author:@me
  allow
  

  While a bare allow remains, the card says anyone can wake agents.
• Rules are saved under a v2 key. Lists saved by an earlier build of this PR aren't converted; they fall back to the defaults.
• Organization membership is read through the existing pull gh command, only for organizations the rules name. It is batched to the 4096-byte input limit, trusted for an hour, and asked one login at a time after a failed batch. An answer older than an hour is not used, even when refreshing it fails. A login whose own read fails ten polls in a row counts as no member. Feedback waits for a later poll only when a rule needs a membership that hasn't been read.
• Known limits: a membership hidden from the signed-in gh account, or one in a misspelled organization, counts as none. Bots and deleted accounts are in no organization.
• Each poll rereads the rules, so a change applies to running watches, including feedback already waiting out the 90-second quiet window. CI and PR-state wakes are not affected.

Validation

src/bundled/github/watcher.test.ts drives the real watcher with the gh command answers faked, so these cover rule evaluation, membership reads and wakes, not live GitHub:

• The default rules tell the viewer's comments and a stranger's, but not the viewer's 🤖 ones.
• Pattern and per-organization rules tell only matching feedback; denied feedback is seen and never told.
• Feedback that needs an unread membership waits, then is told once the membership can be read.
• Tightening the rules while feedback waits in the quiet window keeps the newly denied author's comment from waking the agent. This test failed before the fix, telling the stranger's comment.
• After an hour, a member whose membership refresh fails is not admitted until it can be read again. This test failed before the fix, waking the agent with the later comment.
• Waiting feedback whose author's membership the new rules need, and which can't be read, waits until it can be read rather than being told. This test failed before the fix, telling the comment.

The settings card and the watcher share one stored policy: AuthorSettings.test.tsx saves through the card and reads the result with the watcher's loadPolicy, and the watcher tests above change rules mid-watch through that same storage. tests/browser/settings.spec.mjs checks the settings card in the real app in Chromium and WebKit.

Not tested: the native app against a real pull request and real organization membership.

Screenshots

Default rules, with the warning about a bare allow

A rule that does not compile

Saved organization rules