next-issue 2.14.0 → 2.14.1

package/README.md

@@ -104,7 +104,7 @@ and exits with code 1. For each issue:
 
 ## Issue format
 
-Every agent prompt holds the body and the comments of the issue. An issue reads best with these sections, in this order:
+Every agent prompt holds the body of the issue and the comments of users with write or admin access to the repository. An issue reads best with these sections, in this order:
 
 1. `Problem`
 2. `Context and findings`
@@ -208,12 +208,15 @@ Every agent can run a shell command. The implementer and the fixer run with the
 permission checks off; the reviewer runs with a smaller tool set, but its shell
 has no limit on the commands. They all start in the worktree, but nothing holds
 them there: they can run any command, with your rights, anywhere on the machine.
-The prompt holds the title, the body and the comments of the issue, which come
-from GitHub.
-
-Thus a person who can write an issue or a comment can try to give an
-instruction to the agent. Use the harness only on a repository where you trust
-the issue authors, or run it in a container.
+The prompt holds the title and the body of the issue, which come from GitHub.
+It also holds the comments of the issue, but only those by users with write or
+admin access to the repository. The harness leaves out every other comment and
+writes a `comment.skip` event with its author to the run log. If an access check
+fails for a reason other than a 404, the issue stops with an error.
+
+Thus a person who can write an issue, or a writer who can comment, can try to
+give an instruction to the agent. Use the harness only on a repository where you
+trust the issue authors, or run it in a container.
 
 ## Observability
 

package/dist/github.mjs

@@ -72,7 +72,7 @@ export async function viewIssue(repo, issue) {
 export async function issueComments(repo, issue) {
     const raw = await gh(repo, ['issue', 'view', String(issue), '--json', 'comments']);
     const parsed = JSON.parse(raw);
-    return parsed.comments.map((comment) => `@${comment.author.login}: ${comment.body}`);
+    return parsed.comments.map((comment) => ({ author: comment.author.login, body: comment.body }));
 }
 export async function threadComments(repo, number) {
     const raw = await repeatable([

package/dist/handover.mjs

@@ -40,6 +40,20 @@ export async function waitingQuestions(repo, config, ports) {
     }
     return questions;
 }
+export async function writerComments(context, log, issue) {
+    const { repo, ports } = context;
+    const writer = writers(repo, ports);
+    const kept = [];
+    for (const comment of await ports.issueComments(repo, issue)) {
+        if (await writer(comment.author)) {
+            kept.push(`@${comment.author}: ${comment.body}`);
+        }
+        else {
+            log.event('comment.skip', { author: comment.author }, 'quiet');
+        }
+    }
+    return kept;
+}
 export async function handOverReply(context, issue, pr) {
     const { repo, ports } = context;
     const comments = await ports.threadComments(repo, pr ?? issue);

package/dist/pipeline.mjs

@@ -2,7 +2,7 @@ import { CODING } from './agents.mjs';
 import { commitWork } from './fix.mjs';
 import { checkGate } from './gate.mjs';
 import { branchName } from './git.mjs';
-import { cleanUp, escalate, finish, handOver, handOverReply, skipped, stop } from './handover.mjs';
+import { cleanUp, escalate, finish, handOver, handOverReply, skipped, stop, writerComments, } from './handover.mjs';
 import { openPr, setStatus } from './job.mjs';
 import { afterMerge, fixBase } from './merge.mjs';
 import { message } from './observe.mjs';
@@ -144,7 +144,7 @@ async function work(context, issue, log, state, start, handedOver) {
         await setStatus(context, issue.number, state.pr, config.labels.inProgress);
         await writeState(repo, state);
     });
-    const comments = await log.step('comments', {}, () => ports.issueComments(repo, issue.number));
+    const comments = await log.step('comments', {}, () => writerComments(context, log, issue.number));
     const reply = handedOver
         ? await log.step('reply', {}, () => handOverReply(context, issue.number, state.pr))
         : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-issue",
-  "version": "2.14.0",
+  "version": "2.14.1",
   "description": "Autonomous issue harness driven by the pi SDK",
   "keywords": [
     "github",