Transform Linear persona into chat lead#25
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
CodeAnt AI is reviewing your PR. |
|
Warning Review limit reached
More reviews will be available in 9 minutes and 48 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:XL
khaliqgant
force-pushed
the
codex/1700-linear-chat-lead-scaffold
branch
from
c4748ec to
6af6798
Compare
|
Reviewed the PR artifacts and patched the actual gap. Changed:
Validation:
|
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| issue: LinearIssue, | ||
| eventContext: LinearEventContext, | ||
| ): Promise<string | undefined> { | ||
| const repo = parseRepo(issue) ?? 'AgentWorkforce/cloud'; |
There was a problem hiding this comment.
Suggestion: Repository selection is derived directly from issue text without any allowlist/authorization check, so a user can steer automation to arbitrary GitHub repos by adding a URL in the Linear issue. This can cause unauthorized clone/push/PR attempts against repos reachable by the bot token; restrict delegated repos to an explicit approved list or workspace-configured repo. [security]
Severity Level: Critical 🚨
- ❌ Automation can push commits to unapproved GitHub repositories.
- ❌ PRs may be opened in attacker-chosen external repos.Steps of Reproduction ✅
1. Deploy the Linear agent in `linear/agent.ts` so that `issue.create` events with label
`agentrelay` are handled by `handleLinearEvent` (triggers at lines 52-59 and handler at
lines 66-131).
2. In Linear, create an issue labeled `agentrelay` whose title or description contains an
explicit GitHub URL for an unapproved repo, for example
`https://github.com/attacker/unapproved-repo` (this is what `parseRepo` scans at lines
72-78).
3. When the `issue.create` event arrives, `inferIntent` (lines 212-217) forces `intent ===
'implement'`, so `handleLinearEvent` calls `delegateImplementation` (lines 225-245), which
sets `const repo = parseRepo(issue) ?? 'AgentWorkforce/cloud';` at line 230; `parseRepo`
returns `attacker/unapproved-repo` from the user-provided URL.
4. Inside `workflowSource` (lines 247-329), that unvetted `repo` value is used to
construct `git clone https://github.com/' + REPO + '.git` and `gh pr create --repo ' +
REPO_OWNER + '/' + REPO_NAME` commands (lines 283-317), causing the automation to clone,
commit, push, and open a PR against the user-selected repository using the agent's GitHub
credentials without any allowlist or authorization check.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** linear/agent.ts
**Line:** 230:230
**Comment:**
*Security: Repository selection is derived directly from issue text without any allowlist/authorization check, so a user can steer automation to arbitrary GitHub repos by adding a URL in the Linear issue. This can cause unauthorized clone/push/PR attempts against repos reachable by the bot token; restrict delegated repos to an explicit approved list or workspace-configured repo.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| rec?.agentSession?.issue?.id ?? | ||
| rec?.agentSession?.issue?.identifier ?? | ||
| rec?.issue?.id ?? | ||
| rec?.issue?.identifier ?? | ||
| rec?.notification?.issue?.id ?? | ||
| rec?.notification?.issue?.identifier ?? |
There was a problem hiding this comment.
Suggestion: readIssueId now falls back to issue identifier values (AR-70 style) in places where downstream code treats the value as an issue id; this mixes two different identifiers and can break API calls that require the canonical id. Keep this function id-only and resolve identifiers separately when needed. [api mismatch]
Severity Level: Major ⚠️
- ❌ Some Linear events fail to resolve issues correctly.
- ⚠️ Implementation workflows may never start for affected events.Steps of Reproduction ✅
1. Deploy the Linear agent so that events such as `AgentSessionEvent.created` and
`AppUserNotification.issueCommentMention` are handled by `handleLinearEvent` (lines 52-59
and 66-131), which calls `linearEventContext` (lines 133-141) to populate `issueId` using
`readIssueId`.
2. Consider a Linear payload where `unwrapResourceRecord` (used by `linearRecordPayload`
at lines 50-52) returns a record with `agentSession.issue.identifier` like `"ENG-123"` but
no `agentSession.issue.id`, which is plausible given the additional `agentSession` fields
wired into `readIssueId` (lines 356-367).
3. In this case, `readIssueId`'s return chain (lines 381-387) falls through from
`rec?.agentSession?.issue?.id ??` to `rec?.agentSession?.issue?.identifier ??` and then to
other identifier fields, so `issueId` becomes `"ENG-123"` even though downstream code
expects a canonical id.
4. `handleLinearEvent` then passes `eventContext.issueId` directly into
`linear.getIssue<LinearIssue>(eventContext.issueId)` at line 104, where the
`linearClient()` (imported at line 14) is designed to look up issues by id; using a
human-readable identifier instead can cause the API call to fail or target the wrong
resource, preventing the agent from classifying intent or delegating implementation for
such events.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** linear/agent.ts
**Line:** 382:387
**Comment:**
*Api Mismatch: `readIssueId` now falls back to issue `identifier` values (`AR-70` style) in places where downstream code treats the value as an issue id; this mixes two different identifiers and can break API calls that require the canonical id. Keep this function id-only and resolve identifiers separately when needed.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
CodeAnt AI finished reviewing your PR. |
khaliqgant
force-pushed
the
codex/1700-linear-chat-lead-scaffold
branch
from
6af6798 to
195ee61
Compare
|
Reviewed and fixed the PR locally. Changes made:
Local validation passed:
|
khaliqgant
force-pushed
the
codex/1700-linear-chat-lead-scaffold
branch
from
195ee61 to
2728b83
Compare
|
Reviewed and fixed PR #25 locally. Changed:
Validated locally:
|
|
Reviewed PR #25 and made one focused hardening change: added a regression test that writes the generated Linear implementation workflow to a temp Local checks run:
All passed locally. |
|
Reviewed and fixed PR #25 locally. Changed:
Verified locally:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 5 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="linear/agent.ts">
<violation number="1" location="linear/agent.ts:123">
P2: Implement-intent path never stores user message in session memory via `rememberTurn`. The user's prompt is dropped silently, so follow-up events in the same session lose the original request context.</violation>
<violation number="2" location="linear/agent.ts:418">
P2: PR creation is hardcoded to baseBranch 'main', which breaks delegated runs for repositories with a different default branch.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| : []; | ||
| const intent = await classifyIntent(ctx, event, eventContext, issue, history); | ||
|
|
||
| if (intent.intent === 'implement') { |
There was a problem hiding this comment.
P2: Implement-intent path never stores user message in session memory via rememberTurn. The user's prompt is dropped silently, so follow-up events in the same session lose the original request context.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At linear/agent.ts, line 123:
<comment>Implement-intent path never stores user message in session memory via `rememberTurn`. The user's prompt is dropped silently, so follow-up events in the same session lose the original request context.</comment>
<file context>
@@ -54,58 +83,375 @@ export async function handleLinearEvent(
+ : [];
+ const intent = await classifyIntent(ctx, event, eventContext, issue, history);
+
+ if (intent.intent === 'implement') {
+ const start = intent.reply || 'I will start an implementation workflow and post the PR here when it is ready.';
+ await replyToLinear(linear, eventContext, start);
</file context>
| const response = await fetch(cloudApiUrl + '/api/v1/github/pull-request', { | ||
| method: 'POST', | ||
| headers: { authorization: 'Bearer ' + pullRequestAuthToken, 'content-type': 'application/json' }, | ||
| body: JSON.stringify({ owner, repo, branch, baseSha, baseBranch: 'main', title, body, files }), |
There was a problem hiding this comment.
P2: PR creation is hardcoded to baseBranch 'main', which breaks delegated runs for repositories with a different default branch.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At linear/agent.ts, line 418:
<comment>PR creation is hardcoded to baseBranch 'main', which breaks delegated runs for repositories with a different default branch.</comment>
<file context>
@@ -54,58 +83,375 @@ export async function handleLinearEvent(
+const response = await fetch(cloudApiUrl + '/api/v1/github/pull-request', {
+ method: 'POST',
+ headers: { authorization: 'Bearer ' + pullRequestAuthToken, 'content-type': 'application/json' },
+ body: JSON.stringify({ owner, repo, branch, baseSha, baseBranch: 'main', title, body, files }),
+});
+const payload = await response.json().catch(() => ({}));
</file context>
|
Reviewed the checked-out PR metadata, which points to I found and fixed a local CI breakage in package.json: workspace package exports resolve TypeScript declarations from Local verification passed:
|
|
Reviewed PR #25 locally and made one fix: implementation requests now save the user’s prompt to Linear session memory before delegation, matching the chat path and preserving context for follow-up turns. Added test coverage for the implementation memory writes. Local validation passed:
No separate bot-review artifacts were present under |
khaliqgant
force-pushed
the
codex/1700-linear-chat-lead-scaffold
branch
from
2728b83 to
47adf5b
Compare
|
Reviewed PR #25 and made fixes. Changed:
Local verification passed:
|
|
Reviewed PR #25 and fixed the valid findings, including bot-review comments visible on the PR page. Changes made:
Local validation passed:
Source checked for bot comments: #25 |
|
Reviewed and fixed the PR locally. Changes made:
Local verification passed:
|
1 participant
User description
Summary
Verification
Deploy note
No persona deploy in this PR. Operator-gated morning deploy should run: agentworkforce persona compile ./linear/persona.ts && agentworkforce deploy ./linear/persona.json --mode cloud
Summary by cubic
Transforms the Linear persona into a chat lead that runs agent-session conversations, posts thought/response activities, remembers short context, and delegates implementation to a workflow that opens PRs via the Cloud API. Adds a small PR script used by the workflow.
New Features
AgentSessionEvent.created/promptedon/linear/agent-sessions/**and/linear/comments/**, plusAppUserNotification.issueCommentMentionon/linear/app-user-notifications/**with comment fallback; keep label-scopedissue.createon/linear/issues/**.unwrapResourceRecordto read issue id, session id, and prompt body across formats.workflows/linear-chat-lead.ts, run thelinear-chat-leadworkflow, and post the PR URL. Workflow clones the repo and embedslinear/create-pr.script.tsto open PRs via the Cloud API using the workspace token (nogh).linear-chat-leadwithsandbox: false,memory: true, and modelgpt-5.5.Dependencies
@agentworkforce/persona-kitto^3.0.41,@agentworkforce/runtimeto^3.0.41,@relayfile/relay-helpersto^0.3.31, and devagentworkforceto^3.0.41.Written for commit 47adf5b. Summary will update on new commits.
CodeAnt-AI Description
Turn Linear issues into chat-led conversations that can answer, remember context, and hand off implementation
What Changed
Impact
✅ Faster Linear responses✅ Less repeated context in follow-up chats✅ Fewer missed PR links after implementation requests💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.