Proposal: improve ca-bug-hunter — prevent false positive infrastructure bug reports #1595

New issue

Closed

opened 2026-04-02 23:02:09 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:02:09 +00:00

Owner

Agent Improvement Proposal

Pattern Detected

Type: Prompt improvement — false positive bug reports from infrastructure confusion
Affected Agent: ca-bug-hunter (Worker Mode)
Evidence: During the v3.7.0 session, the bug hunter filed at least 2 false positive "Critical" bug reports about TLS/SSL failures on git.cleveragents.com:

Issue	Title	Status	Filed
#1408	BUG-HUNT: [Security] Git clone fails with TLS/SSL handshake error	Closed (false positive)	17:32
#1532	BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com	Open (false positive)	20:43

Root Cause: The bug hunter workers are constructing the git clone URL using git.cleveragents.com (derived from the organization name "cleveragents") instead of the actual Forgejo host git.cleverthis.com (from the FORGEJO_URL environment variable). When the clone fails due to the wrong hostname, the agent files a "Critical" infrastructure bug about TLS misconfiguration — which is actually just the agent using the wrong URL.

Impact:

False positive "Critical" bugs waste human review time and create alarm
The bug hunter cannot actually clone the repo, so it cannot perform any code analysis — the entire worker session is wasted
Issue #1408 was quickly closed as false positive, but #1532 is still open and labeled "State/In progress", consuming attention

Proposed Change

Modify the Worker Mode section in ca-bug-hunter.md to:

Add explicit guidance on hostname resolution — instruct the agent to derive the git host from the FORGEJO_URL environment variable or from the Forgejo PAT URL provided in the prompt, NOT from the organization name. Add a warning: "The Forgejo host is NOT necessarily git.<org-name>.com. Always use the host from FORGEJO_URL or the PAT URL."
Add scope restriction for bug reports — instruct the agent that infrastructure issues (TLS certificates, server configuration, DNS) are OUT OF SCOPE. The bug hunter should only file bugs about source code in the repository. If the clone fails, the agent should log the error and exit gracefully, not file a bug about the infrastructure.
Add clone failure handling — if git clone fails, the agent should: (a) check if it's using the correct hostname, (b) retry with the FORGEJO_URL host, (c) if still failing, exit with an error message rather than filing a false positive bug.

Expected Impact

Eliminates false positive "Critical" infrastructure bug reports
Prevents wasted human review time on non-issues
Ensures bug hunter workers can actually clone and analyze code
Reduces noise in the issue tracker

Risk Assessment

Very low risk: These changes only add guardrails and guidance. No analysis logic is modified.
Potential concern: If a genuine TLS issue exists in the codebase (e.g., in the A2A server code), the scope restriction might cause the agent to miss it. However, the restriction is specifically about the git server infrastructure, not about TLS-related code in the repository.

This is a proposal from the agent evolver. A human must approve this issue before the change will be implemented. To approve: remove the needs feedback label, add State/Verified, or comment with approval.

Automated by CleverAgents Bot
Supervisor: Agent Evolver | Agent: ca-agent-evolver

## Agent Improvement Proposal ### Pattern Detected **Type**: Prompt improvement — false positive bug reports from infrastructure confusion **Affected Agent**: `ca-bug-hunter` (Worker Mode) **Evidence**: During the v3.7.0 session, the bug hunter filed **at least 2 false positive "Critical" bug reports** about TLS/SSL failures on `git.cleveragents.com`: | Issue | Title | Status | Filed | |---|---|---|---| | #1408 | BUG-HUNT: [Security] Git clone fails with TLS/SSL handshake error | Closed (false positive) | 17:32 | | #1532 | BUG-HUNT: [Infrastructure] TLS Configuration Error on git.cleveragents.com | Open (false positive) | 20:43 | **Root Cause**: The bug hunter workers are constructing the git clone URL using `git.cleveragents.com` (derived from the organization name "cleveragents") instead of the actual Forgejo host `git.cleverthis.com` (from the `FORGEJO_URL` environment variable). When the clone fails due to the wrong hostname, the agent files a "Critical" infrastructure bug about TLS misconfiguration — which is actually just the agent using the wrong URL. **Impact**: - False positive "Critical" bugs waste human review time and create alarm - The bug hunter cannot actually clone the repo, so it cannot perform any code analysis — the entire worker session is wasted - Issue #1408 was quickly closed as false positive, but #1532 is still open and labeled "State/In progress", consuming attention ### Proposed Change Modify the Worker Mode section in `ca-bug-hunter.md` to: 1. **Add explicit guidance on hostname resolution** — instruct the agent to derive the git host from the `FORGEJO_URL` environment variable or from the Forgejo PAT URL provided in the prompt, NOT from the organization name. Add a warning: "The Forgejo host is NOT necessarily `git.<org-name>.com`. Always use the host from FORGEJO_URL or the PAT URL." 2. **Add scope restriction for bug reports** — instruct the agent that infrastructure issues (TLS certificates, server configuration, DNS) are OUT OF SCOPE. The bug hunter should only file bugs about **source code** in the repository. If the clone fails, the agent should log the error and exit gracefully, not file a bug about the infrastructure. 3. **Add clone failure handling** — if `git clone` fails, the agent should: (a) check if it's using the correct hostname, (b) retry with the FORGEJO_URL host, (c) if still failing, exit with an error message rather than filing a false positive bug. ### Expected Impact - Eliminates false positive "Critical" infrastructure bug reports - Prevents wasted human review time on non-issues - Ensures bug hunter workers can actually clone and analyze code - Reduces noise in the issue tracker ### Risk Assessment - **Very low risk**: These changes only add guardrails and guidance. No analysis logic is modified. - **Potential concern**: If a genuine TLS issue exists in the codebase (e.g., in the A2A server code), the scope restriction might cause the agent to miss it. However, the restriction is specifically about the *git server infrastructure*, not about TLS-related code in the repository. --- *This is a proposal from the agent evolver. A human must approve this issue before the change will be implemented. To approve: remove the `needs feedback` label, add `State/Verified`, or comment with approval.* --- **Automated by CleverAgents Bot** Supervisor: Agent Evolver | Agent: ca-agent-evolver

Rows
Columns