You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Prevent edited issue and comment events from replaying unchanged embedded /squad invocations, require dual-principal authorization for /squad revoke-improvement, and ensure live improvement revalidation honors only authorized, unedited human revocations.
Why
The clean consumer review at octodemo/zava-social-queue-worker-20261002132914#1 showed that unrelated body edits could redispatch an unchanged accepted or rejected embedded command. It also showed that revoke-improvement mutated durable approval state while remaining publicly open, and an unauthorized revocation comment could still be honored later even after the router refused it.
How
The shared command contract now canonicalizes the prior and current invocation on edited events using changes.body.from; missing/malformed prior evidence and equivalent commands noop, while newly introduced or materially changed accepted/rejected commands retain existing behavior. revoke-improvement was removed from the open-mode set without changing the command allowlist, roles: all, or intentionally public status, review, research, and plan. Issue-body and edited-comment revocations are rejected because they cannot become durable records. Improvement revalidation now live-checks revocation-author permission, rejects edited/app/bot revocations, ignores weak permissions, and fails closed on unresolved evidence or malformed revocation timestamps with bounded lookups. Canonical package sources and integrity manifests were regenerated with npm run gh-aw:integrity:write.
Security review: no new secrets, actions, redirects, PATs, GitHub Apps, private keys, repository secrets, or environment secrets were added. The first consumer compile approved only the repository's existing documented safe-update baseline (SQUAD_GITHUB_APP_PRIVATE_KEY, SQUAD_GITHUB_TOKEN, and bradygaster/squad/.github/actions/squad-init); the final strict compile required no approval and produced exactly the two documented warnings. An independent security review found the revocation revalidation bypass, a different revision author closed it, and the independent security re-review found no vulnerabilities.
⚠️ Quick Check
If SDK/CLI source files changed: completed the applicable Changeset step below (npx changeset add / .changeset/*.md, direct CHANGELOG.md entry for maintainers, or skip-changelog label for no user-facing changes)
PR Readiness Checklist
The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.
Branch & Commit
Branch created from dev (not main)
Branch is up to date with dev (git fetch upstream && git rebase upstream/dev)
Verified diff contains only intended changes (git diff --cached --stat)
PR is not in draft mode (mark ready when checks pass)
Commit history is clean (squash fixups before review)
Build & Test
npm run build passes
npm test passes (all tests green) — waived below because six unrelated linked-worktree-sensitive tests fail locally; the GitHub full-test job passed on the prior head and is rerunning on the final head.
npm run lint passes (type check clean)
npm run lint:eslint passes
For migration PRs (>20 files): include test output summary in PR description — N/A; this is not a migration PR and changes fewer than 20 files.
Consumer gh aw compile --strict --no-check-update — Compiled 8 workflows: 8 succeeded, 2 warnings; only the documented pull_request_target and slash-command/bot warnings.
Compiled squad-command-router.lock.yml contains the edited-event replay gate.
SKIP_BUILD_BUMP=1 npm run build — passed.
npm run lint — passed.
npm run lint:eslint — passed with existing warnings only.
Full npm test was attempted but this linked-worktree environment has 6 unrelated failures in externalized-state/init/consult tests that intentionally resolve the repository's main-checkout .squad state; all 2,048 gh-aw tests are green.
Changeset
Changeset added via npx changeset add (if packages/squad-sdk/src/ or packages/squad-cli/src/ changed)
Or direct CHANGELOG.md entry (maintainers only — write-protected for external contributors) — N/A; the changeset path above was used.
Or skip-changelog label applied (if no user-facing changes) — N/A; the changeset path above was used.
Docs
README section updated (if new feature/module) — N/A; no README feature section applies.
Docs feature page (if new user-facing capability) — authorization behavior updated in the gh-aw guide.
Exports
package.json subpath exports updated (if new module) — N/A; no SDK modules or exports changed.
Breaking Changes
None.
Waivers
Waived: full npm test green status in this linked-worktree environment. Six unrelated externalized-state/init/consult tests intentionally detect and use/refuse the main checkout rather than their temporary fixture; all 2,048 gh-aw tests, focused mutation tests, build, type-check, ESLint, integrity verification, install-contract tests, and strict compilation pass. Requires repository reviewer approval before merge.
This raises the declared worst-case authorization ceiling to 36 requests, but the guide still states that improvement authorization is bounded to fourteen reads per check (docs/src/content/docs/guide/gh-aw.md:892). Update that operational limit so users can size API-rate usage accurately.
This issue also appears on line 353 of the same file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Prevent edited issue and comment events from replaying unchanged embedded
/squadinvocations, require dual-principal authorization for/squad revoke-improvement, and ensure live improvement revalidation honors only authorized, unedited human revocations.Why
The clean consumer review at octodemo/zava-social-queue-worker-20261002132914#1 showed that unrelated body edits could redispatch an unchanged accepted or rejected embedded command. It also showed that
revoke-improvementmutated durable approval state while remaining publicly open, and an unauthorized revocation comment could still be honored later even after the router refused it.How
The shared command contract now canonicalizes the prior and current invocation on
editedevents usingchanges.body.from; missing/malformed prior evidence and equivalent commands noop, while newly introduced or materially changed accepted/rejected commands retain existing behavior.revoke-improvementwas removed from the open-mode set without changing the command allowlist,roles: all, or intentionally publicstatus,review,research, andplan. Issue-body and edited-comment revocations are rejected because they cannot become durable records. Improvement revalidation now live-checks revocation-author permission, rejects edited/app/bot revocations, ignores weak permissions, and fails closed on unresolved evidence or malformed revocation timestamps with bounded lookups. Canonical package sources and integrity manifests were regenerated withnpm run gh-aw:integrity:write.Security review: no new secrets, actions, redirects, PATs, GitHub Apps, private keys, repository secrets, or environment secrets were added. The first consumer compile approved only the repository's existing documented safe-update baseline (
SQUAD_GITHUB_APP_PRIVATE_KEY,SQUAD_GITHUB_TOKEN, andbradygaster/squad/.github/actions/squad-init); the final strict compile required no approval and produced exactly the two documented warnings. An independent security review found the revocation revalidation bypass, a different revision author closed it, and the independent security re-review found no vulnerabilities.npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes)PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)Build & Test
npm run buildpassesnpm testpasses (all tests green) — waived below because six unrelated linked-worktree-sensitive tests fail locally; the GitHub full-test job passed on the prior head and is rerunning on the final head.npm run lintpasses (type check clean)npm run lint:eslintpassesValidation evidence:
npm exec vitest run test/gh-aw-*.test.ts— passed: 29 files, 2,048 tests.npm run gh-aw:integrity:check— passed.gh aw compile --strict --no-check-update—Compiled 8 workflows: 8 succeeded, 2 warnings; only the documentedpull_request_targetand slash-command/bot warnings.squad-command-router.lock.ymlcontains the edited-event replay gate.SKIP_BUILD_BUMP=1 npm run build— passed.npm run lint— passed.npm run lint:eslint— passed with existing warnings only.npm testwas attempted but this linked-worktree environment has 6 unrelated failures in externalized-state/init/consult tests that intentionally resolve the repository's main-checkout.squadstate; all 2,048 gh-aw tests are green.Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only — write-protected for external contributors) — N/A; the changeset path above was used.skip-changeloglabel applied (if no user-facing changes) — N/A; the changeset path above was used.Docs
Exports
Breaking Changes
None.
Waivers
Waived: full
npm testgreen status in this linked-worktree environment. Six unrelated externalized-state/init/consult tests intentionally detect and use/refuse the main checkout rather than their temporary fixture; all 2,048 gh-aw tests, focused mutation tests, build, type-check, ESLint, integrity verification, install-contract tests, and strict compilation pass. Requires repository reviewer approval before merge.