You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(gh-aw): enforce maintainer authorization for direct Squad commands - #2187
Enforces deterministic authorization for direct /squad commands and restricts open-mode outputs across the dispatcher, command router, custom safe-output jobs, and gh-aw conclusion handlers. Ships a coherent regenerated workflow package and integrity manifest, with no consumer hand-edits or release publication.
Why
Closes#2185. Direct slash commands previously bypassed the router's permission check and relied on agent instructions. An unprivileged invocation must not gain issue/PR creation, worker dispatch, acceptance artifacts, or unrelated tracking-issue writes through emitted agent output. This revision also includes the already-merged bootstrap cleanup fix from #2158 through its base ancestry, for the subsequent bradygaster/eShop update.
How
Share fail-closed actor/original-author authorization between direct and router paths, including changed-text edit evidence and live write/maintain/admin permission checks.
Preserve authenticated platform workflow_dispatch continuations; never derive that authorization from issue text or aw_context claims. Open-mode output restrictions remain in force for dispatched commands.
Restrict public status/review/research/plan outputs to the originating issue and permitted draft/nonterminal artifacts. Validate the complete batch before built-in handlers. Gate research/lifecycle custom jobs on successful safe-output enforcement.
Disable issue-writing failure/detection/noop conclusion paths and raw-noop activation/completion comments. Keep failure status, detection enforcement, logs and summaries. Conclusion tokens still have write permissions; pinned-runtime tests verify the configuration-controlled early exits.
Test the actual pinned gh-aw sanitizer, downstream lifecycle interpreter and diagnostic handlers, including positive mutation controls, failed-guard conclusion execution, and strict-compiled configuration mutations. Independent specialists revised both discovered bypasses; final bounded security re-review: APPROVE, no findings.
Addressed Copilot's test-maintenance findings: updated stale activation-capacity runtime documentation and reused the shared diagnostic runtime pin for sanitizer validation. Copilot re-review of f8563c7 reports 0 open findings; all inline threads are resolved. Its general recommendation for human review is advisory, not an approving human review.
Validation evidence
node workflows/shared/squad-install-verifier.mjs --write-source — passed; canonical/package sources and integrity manifest regenerated with gh-aw v0.89.22.
node workflows/shared/squad-install-verifier.mjs --check-source — passed, including strict compilation and normalized lock digest checks.
npm test -- --run test/gh-aw-command-authorization.test.ts test/gh-aw-command-parse.test.ts test/gh-aw-command-router-relay.test.ts test/gh-aw-quality.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-lifecycle-upsert.test.ts test/gh-aw-install-staging.test.ts test/gh-aw-improvement-worker.test.ts test/gh-aw-implement-workflow.test.ts — 894 passed across 9 suites, including complete consumer-installation fixtures and legitimate continuation cases.
npm test -- --run test/gh-aw-activation-capacity.test.ts test/gh-aw-command-authorization.test.ts — 62 passed after both Copilot corrections.
SKIP_BUILD_BUMP=1 npm run build — passed.
npm run lint — passed locally and in final CI.
npm run lint:eslint — passed locally and in final CI, 0 errors; repository-wide existing warnings remain.
node_modules/.bin/eslint test/gh-aw-command-authorization.test.ts test/gh-aw-command-parse.test.ts test/gh-aw-command-router-relay.test.ts test/gh-aw-quality.test.ts test/helpers/gh-aw-diagnostic-runtime.ts — passed on the security-approved revision.
node_modules/.bin/eslint test/gh-aw-activation-capacity.test.ts test/gh-aw-command-authorization.test.ts — passed after both Copilot corrections.
git diff --cached --check and git diff --check — passed; final PR scope is 17 intended files, no deletions.
Final required Squad CI run 37838884119 on f8563c7: gh-aw strict compilepassed; testpassed. Its full npm test completed with 10,642 passed, 2 skipped, 47 todo across 331 passed files.
Full local npm test -- --maxWorkers=4 was interrupted to honor the independent-revision worktree freeze; full-suite success above is the completed GitHub CI result, not that interrupted local run.
Local restore note: the corporate proxy lacked locked @types/node@26.6.4; local validation used available 26.6.3 with lockfile writes disabled. All tracked dependency manifests and the lockfile were restored unchanged. No dependency upgrade is included.
⚠️ Quick Check
If SDK/CLI source files changed: completed the applicable Changeset step below (npx changeset add / .changeset/*.md, direct CHANGELOG.md entry for maintainers, or skip-changelog label for no user-facing changes)
N/A: no SDK/CLI product source changed; this is workflow infrastructure, tests, and directly related documentation.
PR Readiness Checklist
The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.
Branch & Commit
Branch created from dev (not main)
Branch is up to date with dev (git fetch upstream && git rebase upstream/dev)
Verified diff contains only intended changes (git diff --cached --stat)
PR is not in draft mode (mark ready when checks pass)
Commit history is clean (squash fixups before review)
The focused implementation and test follow-ups will be squash-merged.
Build & Test
npm run build passes
npm test passes (all tests green)
npm run lint passes (type check clean)
npm run lint:eslint passes
For migration PRs (>20 files): include test output summary in PR description
Full-suite evidence is the successful final GitHub CI run above. Migration item is N/A: 17 files.
Changeset
Changeset added via npx changeset add (if packages/squad-sdk/src/ or packages/squad-cli/src/ changed)
Or direct CHANGELOG.md entry (maintainers only — write-protected for external contributors)
Or skip-changelog label applied (if no user-facing changes)
N/A under repository workflow-infrastructure requirements; no product source or release files changed.
Docs
README section updated (if new feature/module)
Docs feature page (if new user-facing capability)
The gh-aw guide documents authorization, public output limits, diagnostic behavior, and complete-package upgrades. No new README module.
Exports
package.json subpath exports updated (if new module)
N/A: no SDK module or export changes.
Breaking Changes
No public SDK/CLI API changes. Intentional security hardening rejects commands lacking trusted identities and unrelated public-mode outputs. Dispatcher/router diagnostics no longer create tracking issues or forward raw noop text into status comments. Install/update the complete native package at one reviewed immutable SHA; do not patch integrity-pinned files individually.
Waivers
None requested. Required tests/compile and current-head Copilot review are complete. No required check or review policy is bypassed. The existing default-branch Changeset Drift failure (68 pending fragments; run 37751291755) is unrelated; this PR's Changeset Drift check passed.
Reuse shared diagnostic runtime SHA instead of hard-coding it
test/gh-aw-command-authorization.test.ts:55
This independently hard-codes the runtime SHA even though fetchDiagnosticRuntime uses the separately exported DIAGNOSTIC_RUNTIME_SHA. A future pin bump could therefore test the sanitizer from one revision and diagnostic handlers from another while the compiled-lock assertion still passes. Import and reuse the helper's shared SHA (or derive one pin from the compiled lock) for both fetch paths.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Enforces deterministic authorization for direct
/squadcommands and restricts open-mode outputs across the dispatcher, command router, custom safe-output jobs, and gh-aw conclusion handlers. Ships a coherent regenerated workflow package and integrity manifest, with no consumer hand-edits or release publication.Why
Closes #2185. Direct slash commands previously bypassed the router's permission check and relied on agent instructions. An unprivileged invocation must not gain issue/PR creation, worker dispatch, acceptance artifacts, or unrelated tracking-issue writes through emitted agent output. This revision also includes the already-merged bootstrap cleanup fix from #2158 through its base ancestry, for the subsequent bradygaster/eShop update.
How
workflow_dispatchcontinuations; never derive that authorization from issue text oraw_contextclaims. Open-mode output restrictions remain in force for dispatched commands.Validation evidence
node workflows/shared/squad-install-verifier.mjs --write-source— passed; canonical/package sources and integrity manifest regenerated with gh-aw v0.89.22.node workflows/shared/squad-install-verifier.mjs --check-source— passed, including strict compilation and normalized lock digest checks.npm test -- --run test/gh-aw-command-authorization.test.ts test/gh-aw-command-parse.test.ts test/gh-aw-command-router-relay.test.ts test/gh-aw-quality.test.ts test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-lifecycle-upsert.test.ts test/gh-aw-install-staging.test.ts test/gh-aw-improvement-worker.test.ts test/gh-aw-implement-workflow.test.ts— 894 passed across 9 suites, including complete consumer-installation fixtures and legitimate continuation cases.npm test -- --run test/gh-aw-activation-capacity.test.ts test/gh-aw-command-authorization.test.ts— 62 passed after both Copilot corrections.SKIP_BUILD_BUMP=1 npm run build— passed.npm run lint— passed locally and in final CI.npm run lint:eslint— passed locally and in final CI, 0 errors; repository-wide existing warnings remain.node_modules/.bin/eslint test/gh-aw-command-authorization.test.ts test/gh-aw-command-parse.test.ts test/gh-aw-command-router-relay.test.ts test/gh-aw-quality.test.ts test/helpers/gh-aw-diagnostic-runtime.ts— passed on the security-approved revision.node_modules/.bin/eslint test/gh-aw-activation-capacity.test.ts test/gh-aw-command-authorization.test.ts— passed after both Copilot corrections.node_modules/.bin/markdownlint-cli2 docs/src/content/docs/guide/gh-aw.md— passed.git diff --cached --checkandgit diff --check— passed; final PR scope is 17 intended files, no deletions.gh-aw strict compilepassed;testpassed. Its fullnpm testcompleted with 10,642 passed, 2 skipped, 47 todo across 331 passed files.npm test -- --maxWorkers=4was interrupted to honor the independent-revision worktree freeze; full-suite success above is the completed GitHub CI result, not that interrupted local run.Local restore note: the corporate proxy lacked locked
@types/node@26.6.4; local validation used available26.6.3with lockfile writes disabled. All tracked dependency manifests and the lockfile were restored unchanged. No dependency upgrade is included.npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes)N/A: no SDK/CLI product source changed; this is workflow infrastructure, tests, and directly related documentation.
PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)The focused implementation and test follow-ups will be squash-merged.
Build & Test
npm run buildpassesnpm testpasses (all tests green)npm run lintpasses (type check clean)npm run lint:eslintpassesFull-suite evidence is the successful final GitHub CI run above. Migration item is N/A: 17 files.
Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only — write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)N/A under repository workflow-infrastructure requirements; no product source or release files changed.
Docs
The gh-aw guide documents authorization, public output limits, diagnostic behavior, and complete-package upgrades. No new README module.
Exports
N/A: no SDK module or export changes.
Breaking Changes
No public SDK/CLI API changes. Intentional security hardening rejects commands lacking trusted identities and unrelated public-mode outputs. Dispatcher/router diagnostics no longer create tracking issues or forward raw noop text into status comments. Install/update the complete native package at one reviewed immutable SHA; do not patch integrity-pinned files individually.
Waivers
None requested. Required tests/compile and current-head Copilot review are complete. No required check or review policy is bypassed. The existing default-branch Changeset Drift failure (68 pending fragments; run 37751291755) is unrelated; this PR's Changeset Drift check passed.