@benzotti/jedi 0.1.29 → 0.1.31

package/action/workflow-template.yml

@@ -82,6 +82,7 @@ jobs:
             .jdi/persistence/
             .jdi/framework/
             .jdi/config/
+            .jdi/plans/
             .claude/
           key: jedi-state-${{ github.repository }}-${{ steps.pr.outputs.branch || github.head_ref || github.ref_name }}
           restore-keys: |
@@ -127,22 +128,31 @@ jobs:
         run: bun install -g @anthropic-ai/claude-code
 
       # Run Jedi CLI directly — full pipeline with routing, agents, and comment posting
-      # IMPORTANT: All user input is passed via env vars to avoid shell injection
+      # IMPORTANT: All user input is passed via env vars to avoid shell injection.
+      # All arguments are individually quoted to prevent shell expansion.
+      #
+      # Auth gate (opt-in):
+      #   Set repo variable JEDI_AUTH_ENABLED=true to restrict Jedi to write collaborators.
+      #   Set JEDI_ALLOWED_USERS to a comma-separated list for explicit allow-listing.
       - name: Run Jedi
         run: |
-          ARGS="--repo $REPO"
-          [ -n "$COMMENT_ID" ] && ARGS="$ARGS --comment-id $COMMENT_ID"
-          [ -n "$PR_NUMBER" ] && ARGS="$ARGS --pr-number $PR_NUMBER"
-          [ -n "$ISSUE_NUMBER" ] && ARGS="$ARGS --issue-number $ISSUE_NUMBER"
-
-          bunx @benzotti/jedi@latest action "$COMMENT_BODY" $ARGS
+          bunx @benzotti/jedi@latest action "$COMMENT_BODY" \
+            --repo "$REPO" \
+            ${COMMENT_ID:+--comment-id "$COMMENT_ID"} \
+            ${PR_NUMBER:+--pr-number "$PR_NUMBER"} \
+            ${ISSUE_NUMBER:+--issue-number "$ISSUE_NUMBER"} \
+            ${COMMENT_AUTHOR:+--comment-author "$COMMENT_AUTHOR"} \
+            ${ALLOWED_USERS:+--allowed-users "$ALLOWED_USERS"}
         env:
           # Resolve comment body from whichever event type triggered this
           COMMENT_BODY: ${{ github.event.comment.body || github.event.review.body || '' }}
           COMMENT_ID: ${{ github.event.comment.id || github.event.review.id || '' }}
           PR_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number || '' }}
           ISSUE_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number || '' }}
+          COMMENT_AUTHOR: ${{ github.event.comment.user.login || github.event.review.user.login || '' }}
           REPO: ${{ github.repository }}
+          JEDI_AUTH_ENABLED: ${{ vars.JEDI_AUTH_ENABLED || '' }}
+          ALLOWED_USERS: ${{ vars.JEDI_ALLOWED_USERS || '' }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
           GH_TOKEN: ${{ github.token }}
@@ -156,6 +166,7 @@ jobs:
             .jdi/persistence/
             .jdi/framework/
             .jdi/config/
+            .jdi/plans/
             .claude/
           key: jedi-state-${{ github.repository }}-${{ steps.pr.outputs.branch || github.head_ref || github.ref_name }}-${{ github.run_id }}
 
@@ -174,6 +185,7 @@ jobs:
             .jdi/persistence/
             .jdi/framework/
             .jdi/config/
+            .jdi/plans/
             .claude/
           key: jedi-state-${{ github.repository }}-main-promotion-${{ github.sha }}
           restore-keys: |
@@ -187,5 +199,6 @@ jobs:
             .jdi/persistence/
             .jdi/framework/
             .jdi/config/
+            .jdi/plans/
             .claude/
           key: jedi-state-${{ github.repository }}-main-${{ github.sha }}