From bdfd4dd0425f807360478d66df9620a137d04d17 Mon Sep 17 00:00:00 2001 From: clever-agent Date: Fri, 10 Apr 2026 20:37:21 +0000 Subject: [PATCH] fix(agents): implement curl-based reviewer auth for MCP token limitation The Forgejo MCP tools authenticate with a single server-level token that cannot be overridden per-call. The PR Reviewer must use curl with FORGEJO_REVIEWER_PAT for write operations (reviews, comments) to authenticate as the reviewer account. - pr-reviewer.md: added curl allow, denied MCP write tools, added curl-based review/comment API patterns with FORGEJO_REVIEWER_PAT - pr-review-pool-supervisor.md: passes all 3 reviewer creds, documents READ-via-MCP/WRITE-via-curl split - product-builder.md: passes FORGEJO_REVIEWER_PASSWORD to review pool --- .opencode/agents/pr-review-pool-supervisor.md | 13 +++++--- .opencode/agents/pr-reviewer.md | 31 ++++++++++++++++++- .opencode/agents/product-builder.md | 5 +-- 3 files changed, 42 insertions(+), 7 deletions(-) diff --git a/.opencode/agents/pr-review-pool-supervisor.md b/.opencode/agents/pr-review-pool-supervisor.md index 7474d8743..8e3e39828 100644 --- a/.opencode/agents/pr-review-pool-supervisor.md +++ b/.opencode/agents/pr-review-pool-supervisor.md @@ -411,10 +411,15 @@ LOOP FOREVER: While you should check all standard items (spec compliance, tests, etc.), pay SPECIAL ATTENTION to the focus areas above. - CRITICAL: You MUST authenticate using the REVIEWER credentials for all - Forgejo API calls (reviews, comments). Use FORGEJO_REVIEWER_PAT and - FORGEJO_REVIEWER_USERNAME — NOT the primary bot credentials. This enables - formal APPROVED reviews on bot-created PRs. + CRITICAL — Dual-Account Authentication: + - READ operations (get PR, list reviews, get diff): Use the Forgejo MCP tools (primary bot token is fine for reads) + - WRITE operations (post review, post comment): Use curl with FORGEJO_REVIEWER_PAT + - CI log fetching: Pass reviewer web credentials to ci-log-fetcher + + Reviewer credentials (use these for ALL write operations via curl): + FORGEJO_REVIEWER_PAT: $FORGEJO_REVIEWER_PAT + FORGEJO_REVIEWER_USERNAME: $FORGEJO_REVIEWER_USERNAME + FORGEJO_REVIEWER_PASSWORD: $FORGEJO_REVIEWER_PASSWORD Reference summary: {ref_summary} """ diff --git a/.opencode/agents/pr-reviewer.md b/.opencode/agents/pr-reviewer.md index 62619fd4d..f12f30700 100644 --- a/.opencode/agents/pr-reviewer.md +++ b/.opencode/agents/pr-reviewer.md @@ -14,6 +14,8 @@ permission: edit: deny bash: "*": deny + # Allow curl for reviewer-authenticated API calls (reviews, comments) + "curl *": allow # Block ALL commands that could hit the label creation endpoints "*api/v1/orgs/*/labels*": deny "*api/v1/repos/*/labels*": deny @@ -24,6 +26,11 @@ permission: "ci-log-fetcher": allow forgejo: "*": allow + # WRITE operations that create reviews/comments MUST use curl with + # FORGEJO_REVIEWER_PAT instead of these MCP tools (which authenticate + # as the primary bot). These denies enforce that: + "forgejo_create_pull_review": deny + "forgejo_create_issue_comment": deny # CRITICAL: Label creation is COMPLETELY FORBIDDEN "forgejo_create_label": deny "forgejo_create_org_label": deny @@ -426,7 +433,29 @@ Every review decision requires TWO actions performed in this order: **Why both?** The formal review (Step 1) is the standard Forgejo mechanism and the primary signal that merge automation checks. The issue comment (Step 2) provides a durable backup that is visible even if review UIs are filtered or collapsed, and enables human readers to see the full review rationale. -**IMPORTANT: You MUST authenticate using the reviewer credentials**, not the primary bot credentials. Your caller (the PR Review Pool Supervisor) passes these as `FORGEJO_REVIEWER_PAT` and `FORGEJO_REVIEWER_USERNAME`. All your Forgejo API calls use these credentials. +**IMPORTANT: Authentication Split — READ via MCP, WRITE via curl** + +The Forgejo MCP tools (`forgejo_get_pull_request_by_index`, `forgejo_list_pull_reviews`, etc.) authenticate as the PRIMARY bot account. This is fine for READ operations (getting PR details, diffs, existing reviews). + +However, WRITE operations (posting reviews and comments) MUST come from the REVIEWER account to enable formal APPROVED reviews. Since the MCP tools can't switch tokens, you MUST use curl with `FORGEJO_REVIEWER_PAT` for all writes: + +```bash +# Post a formal review (APPROVED or REQUEST_CHANGES) — as reviewer account +curl -s -X POST "https://git.cleverthis.com/api/v1/repos/{owner}/{repo}/pulls/{pr_number}/reviews" \ + -H "Authorization: token $FORGEJO_REVIEWER_PAT" \ + -H "Content-Type: application/json" \ + -d '{"body": "", "event": "APPROVED"}' + +# Post a backup issue comment — as reviewer account +curl -s -X POST "https://git.cleverthis.com/api/v1/repos/{owner}/{repo}/issues/{pr_number}/comments" \ + -H "Authorization: token $FORGEJO_REVIEWER_PAT" \ + -H "Content-Type: application/json" \ + -d '{"body": ""}' +``` + +Your caller (the PR Review Pool Supervisor) passes `FORGEJO_REVIEWER_PAT`, `FORGEJO_REVIEWER_USERNAME`, and `FORGEJO_REVIEWER_PASSWORD` in your prompt. When invoking `ci-log-fetcher`, pass the reviewer credentials as overrides: `forgejo_username: $FORGEJO_REVIEWER_USERNAME, forgejo_password: $FORGEJO_REVIEWER_PASSWORD`. + +**DO NOT use `forgejo_create_pull_review` or `forgejo_create_issue_comment` MCP tools** — these are denied in your permissions because they would authenticate as the primary bot, defeating the dual-account architecture. #### APPROVE diff --git a/.opencode/agents/product-builder.md b/.opencode/agents/product-builder.md index 287cab5e6..373db5fb8 100644 --- a/.opencode/agents/product-builder.md +++ b/.opencode/agents/product-builder.md @@ -796,9 +796,10 @@ launch_supervisor("pr-review-pool-supervisor", "reviewer-pool", "AUTO-REV-SUP", "You are the PR review pool supervisor. Repo: /. Instance ID: reviewer-pool-1. Forgejo PAT: . Git: . Username: . Password: . - REVIEWER CREDENTIALS (for PR reviews): Reviewer PAT: . Reviewer Username: . + REVIEWER CREDENTIALS (for PR reviews): Reviewer PAT: . Reviewer Username: . Reviewer Password: . The reviewer account is a SEPARATE Forgejo user that can formally APPROVE PRs created by the primary bot. - Pass these reviewer credentials to every pr-reviewer subagent you dispatch. + Pass ALL THREE reviewer credentials to every pr-reviewer subagent you dispatch. + The PR Reviewer uses curl (not MCP tools) for write operations to authenticate as the reviewer. Max workers: N_HALF. When creating tracking issues, ALWAYS include these labels: Type/Automation, State/In Progress, Priority/Medium")