From 8380822717d18b33830dfffea0917ff7aead6a23 Mon Sep 17 00:00:00 2001
From: Jeffrey Phillips Freeman <the@jeffreyfreeman.me>
Date: Sun, 5 Apr 2026 06:41:30 +0000
Subject: [PATCH] =?UTF-8?q?chore(agents):=20improve=20ca-bug-hunter=20?=
 =?UTF-8?q?=E2=80=94=20prevent=20false=20positive=20infrastructure=20bug?=
 =?UTF-8?q?=20reports?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Approved proposal: #1595
Pattern: prompt_improvement — false positive bug reports from infrastructure confusion
Evidence: Bug hunter filed 2+ false positive Critical bug reports about TLS/SSL
failures on git.cleveragents.com (wrong hostname derived from org name instead of
using git.cleverthis.com from FORGEJO_URL). Issues #1408 and #1532 were false positives.
Fix: Add hostname resolution guidance, clone failure handling with retry logic,
and explicit scope restriction against filing infrastructure issues.

ISSUES CLOSED: #1595
---
 .opencode/agents/ca-bug-hunter.md | 32 +++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/.opencode/agents/ca-bug-hunter.md b/.opencode/agents/ca-bug-hunter.md
index d2b65163f..542c6bc50 100644
--- a/.opencode/agents/ca-bug-hunter.md
+++ b/.opencode/agents/ca-bug-hunter.md
@@ -215,12 +215,19 @@ LOOP:
 
 **CRITICAL: You MUST work in your own isolated clone. NEVER operate in /app.**
 
+**HOSTNAME WARNING:** The Forgejo host is NOT necessarily
+`git.<org-name>.com`. You MUST derive the git clone hostname from the
+Forgejo base URL or PAT URL provided in your prompt — NOT from the
+organization name. For example, if the Forgejo URL is
+`https://git.cleverthis.com`, use `git.cleverthis.com` as the host, even
+if the org is named `cleveragents`.
+
 ```bash
 INSTANCE_ID="bug-hunter-$$-$(date +%s)"
 CLONE_DIR="/tmp/ca-${INSTANCE_ID}"
 
-# Clone
-git clone https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
+# Clone — use the host from FORGEJO_URL, NOT from the org name
+git clone https://<FORGEJO_PAT>@<FORGEJO_HOST>/<owner>/<repo>.git "$CLONE_DIR"
 
 # Configure identity (read-only, but git needs this)
 cd "$CLONE_DIR"
@@ -232,6 +239,22 @@ git config user.email "<GIT_USER_EMAIL>"
 
 **CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error.
 
+### Clone Failure Handling
+
+If `git clone` fails:
+
+1. **Check the hostname.** Verify you are using the host from the Forgejo
+   base URL (e.g., `git.cleverthis.com`), NOT a hostname derived from the
+   organization name (e.g., `git.cleveragents.com`).
+2. **Retry once** with the corrected hostname if it was wrong.
+3. **If still failing after retry, EXIT gracefully.** Report the clone
+   failure in your return value and move on. Do NOT file a Forgejo issue
+   about the clone failure — it is an agent environment problem, not a
+   product bug.
+4. **NEVER file issues about TLS, DNS, or network failures** encountered
+   during your own clone operation. These are infrastructure issues in
+   your execution environment, not bugs in the product codebase.
+
 ### Setup
 
 You receive:
@@ -497,6 +520,11 @@ Before filing ANY issue, you MUST validate the finding:
   get assigned to the active milestone. All other findings are created with
   no milestone and `Priority/Backlog`. This prevents scope explosion in
   active milestones.
+- **NEVER file issues about your own infrastructure.** TLS/SSL failures,
+  DNS resolution errors, clone failures, tool crashes, and network issues
+  in YOUR execution environment are NOT product bugs. They are agent
+  environment problems. If you cannot clone or access the code, exit
+  gracefully — do not file a bug report about it.
 
 ---
 
-- 
2.52.0