Replace setup skill with linked agent installer - #56
Conversation
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (32)
💤 Files with no reviewable changes (3)
📝 WalkthroughWalkthroughThe repository replaces the persistent ChangesAgent-led installation model
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CodingAgent
participant AgentInstallationGuide
participant Repository
CodingAgent->>AgentInstallationGuide: follow installation procedure
AgentInstallationGuide->>Repository: install four runtime skills
AgentInstallationGuide->>Repository: initialize and validate vault
AgentInstallationGuide->>Repository: copy workflows and merge hooks
Repository-->>CodingAgent: report installation and verification results
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
plugins/knowledge-distillery/install/hooks/pre-commit-memento.sh (1)
21-24: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRequire a note attachment operation before allowing the commit.
git commit -m "x"; git notes listpasses this condition and creates an undocumented commit. The PostToolUse hook only sends a reminder after the commit. Require the installed memento command shape, includinggit notes ... add, before bypassing the block. Add a regression test for an unrelatedgit notescommand.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/hooks/pre-commit-memento.sh` around lines 21 - 24, Update the command check in the pre-commit hook to bypass only the installed memento command shape containing git notes followed by the add operation, rather than any git notes command. Preserve blocking for commits paired with unrelated git notes commands, and add a regression test covering that unrelated command.
🧹 Nitpick comments (2)
plugins/knowledge-distillery/install/workflows/apply-changeset.yml (1)
57-63: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAdd a concurrency group to the apply job.
The workflow has no
concurrency:block. Two batch Report PRs that merge close together start twoapply-changesetjobs on the same base ref. Both jobs run_changeset-applyagainst.knowledge/vault.dband then push, so one push fails or one vault write is lost. Serialize the job per base ref.♻️ Proposed change
apply-changeset: if: >- github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'knowledge/batch-') runs-on: ubuntu-latest + concurrency: + group: knowledge-apply-changeset-${{ github.event.pull_request.base.ref }} + cancel-in-progress: false permissions: contents: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml` around lines 57 - 63, Add a concurrency configuration for the apply-changeset job so executions are serialized per base ref, using a group keyed by the target branch (for example, github.event.pull_request.base.ref) and preserving the existing job condition and permissions.plugins/knowledge-distillery/install/workflows/curate-report.yml (1)
9-12: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueMatch the
/curatecommand more strictly, and serialize the job.
contains(github.event.comment.body, '/curate')matches the substring anywhere in the body. A comment that quotes an earlier command, or a word such as/curated, triggers a new run. The workflow also has noconcurrency:block, so two/curatecomments produce two jobs that commit to the same branch.Match the command at the start of the body, and add a concurrency group keyed on the issue number.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/curate-report.yml` around lines 9 - 12, Update the workflow trigger condition around the existing /curate check to match only when the comment body starts with the exact /curate command, rather than matching the substring anywhere. Add a concurrency configuration for the job using the issue number as the group key so multiple /curate comments on the same issue serialize.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/agent-installation.md`:
- Around line 109-119: Update the verification steps in the “Verify and Report”
section to run bash -n against all three active-host hook scripts and
parse/validate the merged JSON configuration before reporting success. Reuse the
existing checks from tests/installation-assets.sh rather than adding unrelated
validation.
- Around line 13-24: Update the Codex and Claude Code installation instructions
to pin the remote knowledge-distillery source to an immutable tag or commit
instead of main. Revise the workflow and host-hook copy instructions to use the
same pinned revision, record that revision alongside every managed path, and
require content and configuration review for both hosts before activation.
- Around line 35-43: Expand the existing-vault validation instructions in the
installation guide to define what happens when PRAGMA user_version or any
required table check fails. Add a supported read-only health command or
explicitly permit read-only SQL inspection, then document a safe recovery path
using backup followed by migration or regeneration, and abort when recovery is
unsupported; preserve the requirement not to mutate the original vault.
- Around line 70-76: Update the directive-file selection instructions to branch
on the detected host: use AGENTS.md for Codex and CLAUDE.md for Claude Code.
Explicitly define the behavior when both integrations are requested, while
preserving existing content and appending only missing headings.
In `@plugins/knowledge-distillery/install/hooks/claude-settings.json`:
- Around line 3-6: Remove the direct sqlite3 vault permission from
plugins/knowledge-distillery/install/hooks/claude-settings.json, leaving only
the knowledge-gate permission. In tests/installation-assets.sh, remove the
assertion requiring that direct database permission; no other installation
permission checks need to change.
In `@plugins/knowledge-distillery/install/hooks/post-commit-memento.sh`:
- Around line 16-18: Update the SHA extraction after the OUTPUT assignment to
parse only Git’s commit status line rather than selecting the first hexadecimal
token anywhere in the output, so hexadecimal branch-name components cannot be
mistaken for the commit SHA. Add a regression test covering a branch name such
as feature/cafebabe and verify that the actual commit SHA is extracted.
- Around line 11-27: Update the post-commit hook’s command handling to exit
early for commit messages beginning with “decision:” before extracting SHA or
checking notes, matching the PreToolUse exception. Add a regression test
covering a decision: commit and verifying that no missing-note reminder is
emitted.
In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml`:
- Around line 132-154: Gate the “Clean up batch artifacts” step on an explicit
success output from the preceding vault commit step, so it runs only when that
commit actually succeeds. Define and propagate the commit step’s output, then
reference it in the cleanup step’s condition while preserving the existing
artifact removal and push logic.
- Around line 121-131: Update the “Commit and push vault.db” step to detect both
tracked modifications and an initially untracked .knowledge/vault.db using git
status --porcelain, while preserving the no-change early exit. After committing,
rebase onto the current github.event.pull_request.base.ref before pushing so
concurrent updates are incorporated and the push is protected.
In `@plugins/knowledge-distillery/install/workflows/batch-refine.yml`:
- Around line 47-51: Update
plugins/knowledge-distillery/install/workflows/batch-refine.yml lines 47-51 by
binding LINEAR_API_KEY, SLACK_API_KEY, NOTION_API_KEY, and the MCP GITHUB_TOKEN
through the step env block, then mask and serialize those environment variables
with jq rather than interpolating secrets into shell or JSON. Apply the same
change in plugins/knowledge-distillery/install/workflows/mark-evidence.yml line
33 for LINEAR_API_KEY and the MCP GITHUB_TOKEN; both workflows must safely
handle secret values containing shell or JSON metacharacters.
- Around line 55-62: Update the github MCP Authorization header in
plugins/knowledge-distillery/install/workflows/batch-refine.yml:55-62,
curate-report.yml:60-67, and mark-evidence.yml:37-44 to use a supported PAT or
GitHub App token secret instead of secrets.GITHUB_TOKEN. Add
installation/configuration documentation naming the required secret and token
scope, or implement stateless token support if that is the chosen approach.
In `@README.md`:
- Around line 34-36: Update the installation instruction in the README to
reference a reviewed immutable release tag or commit SHA instead of the mutable
main branch, ensuring the pinned revision contains both the reviewed README and
agent-installation guide while preserving the existing instruction text.
---
Outside diff comments:
In `@plugins/knowledge-distillery/install/hooks/pre-commit-memento.sh`:
- Around line 21-24: Update the command check in the pre-commit hook to bypass
only the installed memento command shape containing git notes followed by the
add operation, rather than any git notes command. Preserve blocking for commits
paired with unrelated git notes commands, and add a regression test covering
that unrelated command.
---
Nitpick comments:
In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml`:
- Around line 57-63: Add a concurrency configuration for the apply-changeset job
so executions are serialized per base ref, using a group keyed by the target
branch (for example, github.event.pull_request.base.ref) and preserving the
existing job condition and permissions.
In `@plugins/knowledge-distillery/install/workflows/curate-report.yml`:
- Around line 9-12: Update the workflow trigger condition around the existing
/curate check to match only when the comment body starts with the exact /curate
command, rather than matching the substring anywhere. Add a concurrency
configuration for the job using the issue number as the group key so multiple
/curate comments on the same issue serialize.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ade9abc5-59e1-4292-b980-b23117744b9b
📒 Files selected for processing (32)
.knowledge/decisions/2026-07-31-linked-agent-installation-contract.md.knowledge/decisions/2026-07-31-llm-led-selective-installation.md.knowledge/decisions/2026-07-31-readme-replaces-setup-skill.mdREADME.mddocs/adoption-guide.mddocs/agent-installation.mddocs/design-implementation.mddocs/ko/README.mddocs/ko/adoption-guide.mddocs/ko/design-implementation.mddocs/ko/tool-evaluation.mddocs/tool-evaluation.mdplugins/knowledge-distillery/install/hooks/claude-settings.jsonplugins/knowledge-distillery/install/hooks/codex-hooks.jsonplugins/knowledge-distillery/install/hooks/post-commit-memento.shplugins/knowledge-distillery/install/hooks/pre-commit-memento.shplugins/knowledge-distillery/install/hooks/pre-prompt-knowledge-gate.shplugins/knowledge-distillery/install/workflows/apply-changeset.ymlplugins/knowledge-distillery/install/workflows/batch-refine.ymlplugins/knowledge-distillery/install/workflows/curate-report.ymlplugins/knowledge-distillery/install/workflows/mark-evidence.ymlplugins/knowledge-distillery/skills/memento-commit/SKILL.mdplugins/knowledge-distillery/skills/record-decision/SKILL.mdplugins/knowledge-distillery/skills/setup/SKILL.mdplugins/knowledge-distillery/skills/setup/scripts/install-hookstests/all.shtests/batch-refine-orchestration.shtests/fixtures/orchestration/batch-refine.jsontests/installation-assets.shtests/prompt-contracts.shtests/setup-hooks.shtests/skill-packaging.sh
💤 Files with no reviewable changes (3)
- tests/setup-hooks.sh
- plugins/knowledge-distillery/skills/setup/SKILL.md
- plugins/knowledge-distillery/skills/setup/scripts/install-hooks
| ```bash | ||
| # Codex | ||
| npx skills add https://github.com/ether-moon/knowledge-distillery/tree/main/plugins/knowledge-distillery \ | ||
| --skill knowledge-gate --skill memento-commit \ | ||
| --skill memento-summary --skill record-decision \ | ||
| -a codex -y | ||
|
|
||
| # Claude Code with portable project skills | ||
| npx skills add https://github.com/ether-moon/knowledge-distillery/tree/main/plugins/knowledge-distillery \ | ||
| --skill knowledge-gate --skill memento-commit \ | ||
| --skill memento-summary --skill record-decision \ | ||
| -a claude-code -y |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files 'docs/**' | sed -n '1,120p'
echo "== agent-installation outline/size =="
wc -l docs/agent-installation.md
sed -n '1,180p' docs/agent-installation.md
echo "== search refs/commands around assets =="
rg -n "npx skills add|github\.com|skills\.config|hook|workflow|review|immutable|revision|tag|commit|main" docs/agent-installation.md plugins docs -S || trueRepository: ether-moon/knowledge-distillery
Length of output: 50390
Pin remote install assets to an immutable revision.
Both npx skills add commands fetch from the mutable main branch, and the workflow/hook copy-on instructions also pull installed content from the repo without reporting a resolved revision. Pin skills, workflow templates, and host hook assets to a tag or commit, record that revision alongside every managed path, and require content plus configuration review for both host hosts before activation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/agent-installation.md` around lines 13 - 24, Update the Codex and Claude
Code installation instructions to pin the remote knowledge-distillery source to
an immutable tag or commit instead of main. Revise the workflow and host-hook
copy instructions to use the same pinned revision, record that revision
alongside every managed path, and require content and configuration review for
both hosts before activation.
| If `.knowledge/vault.db` is absent, initialize it with that exact CLI path: | ||
|
|
||
| ```bash | ||
| <knowledge-gate-path> init-db .knowledge/vault.db | ||
| ``` | ||
|
|
||
| If the vault exists, do not replace or mutate it. Require `PRAGMA user_version` ≥ 1 and confirm that all five required tables are present: `entries`, `entry_domains`, `domain_registry`, `domain_paths`, and `evidence`. | ||
|
|
||
| Create `.knowledge/reports`, `.knowledge/changesets`, and `.knowledge/decisions`. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n 'user_version|init-db|migrate|health|entries|entry_domains|domain_registry|domain_paths|evidence' \
docs plugins testsRepository: ether-moon/knowledge-distillery
Length of output: 50388
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- docs/agent-installation.md lines 30-50 ---\n'
sed -n '30,50p' docs/agent-installation.md
printf '\n--- docs/design-implementation.md around SQL prohibition lines 335-345 ---\n'
sed -n '335,345p' docs/design-implementation.md
printf '\n--- docs/agent-installation.md lines 108-117 ---\n'
sed -n '108,117p' docs/agent-installation.md
printf '\n--- tests/skill-packaging.sh lines 128-145 ---\n'
sed -n '128,145p' tests/skill-packaging.sh
printf '\n--- tests/knowledge-gate.sh around initialization and migrate tests ---\n'
sed -n '100,115p' tests/knowledge-gate.sh
sed -n '550,560p' tests/knowledge-gate.sh
printf '\n--- focused source search for user_version init-db migrate health table checks ---\n'
rg -n --hidden --glob '!**/node_modules/**' --glob '!**/dist/**' --glob '!**/build/**' \
'user_version|init-db|migrate|health|sqlite_master|entries|entry_domains|domain_registry|domain_paths|evidence' \
plugins/knowledge-distillery -SRepository: ether-moon/knowledge-distillery
Length of output: 260
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- docs/agent-installation.md lines 30-50 ---'
sed -n '30,50p' docs/agent-installation.md
echo
echo '--- docs/design-implementation.md around SQL prohibition lines 335-345 ---'
sed -n '335,345p' docs/design-implementation.md
echo
echo '--- docs/agent-installation.md lines 108-117 ---'
sed -n '108,117p' docs/agent-installation.md
echo
echo '--- tests/skill-packaging.sh lines 128-145 ---'
sed -n '128,145p' tests/skill-packaging.sh
echo
echo '--- tests/knowledge-gate.sh around initialization and migrate tests ---'
sed -n '100,115p' tests/knowledge-gate.sh
sed -n '550,560p' tests/knowledge-gate.sh
echo
echo '--- focused source search for user_version init-db migrate health table checks ---'
rg -n --hidden --glob '!**/node_modules/**' --glob '!**/dist/**' --glob '!**/build/**' \
'user_version|init-db|migrate|health|sqlite_master|entries|entry_domains|domain_registry|domain_paths|evidence' \
plugins/knowledge-distillery -SRepository: ether-moon/knowledge-distillery
Length of output: 50389
Define the existing-vault recovery path.
The guide requires the existing vault to pass PRAGMA user_version >= 1 plus five tables, but provides no next step when it fails. Add a supported read-only health command or an explicit read-only SQL exemption, then specify a safe recovery path such as backup plus migration/regeneration, or abort if unsupported.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/agent-installation.md` around lines 35 - 43, Expand the existing-vault
validation instructions in the installation guide to define what happens when
PRAGMA user_version or any required table check fails. Add a supported read-only
health command or explicitly permit read-only SQL inspection, then document a
safe recovery path using backup followed by migration or regeneration, and abort
when recovery is unsupported; preserve the requirement not to mutate the
original vault.
| Choose the directive file in this order: | ||
|
|
||
| 1. Use `AGENTS.md` when it exists or is imported by `CLAUDE.md`. | ||
| 2. Otherwise use an existing `CLAUDE.md`. | ||
| 3. Create `CLAUDE.md` when neither file exists. | ||
|
|
||
| Append each missing heading while preserving existing content: |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate doc =="
fd -a 'agent-installation\.md$' . || true
echo "== relevant sections =="
if [ -f docs/agent-installation.md ]; then
wc -l docs/agent-installation.md
sed -n '1,140p' docs/agent-installation.md | cat -n
fi
echo "== search AGENTS/CLAUDE/Codex/Claude installs =="
rg -n "AGENTS|CLAUDE|Codex|Claude|active host|host-aware|Choose the directive|directive file" docs README.md .github 2>/dev/null || trueRepository: ether-moon/knowledge-distillery
Length of output: 22795
🌐 Web query:
Codex AGENTS.md directive file active host installation guide CLAUDE.md
💡 Result:
AGENTS.md and CLAUDE.md are specialized instruction files used to provide AI coding agents with project-specific context, such as build commands, coding conventions, and architectural rules [1][2][3]. While they serve similar purposes, they originate from different ecosystems and are read by different tools [1][4]. AGENTS.md and CLAUDE.md Installation and Usage AGENTS.md is an open convention originally popularized by OpenAI's Codex CLI and now widely adopted by various agents, including Cursor, Zed, and GitHub Copilot [1][4][5]. CLAUDE.md is the native instruction format for Anthropic's Claude Code [1][6]. 1. Installation and Setup: - Create the file: Place an AGENTS.md or CLAUDE.md file in the root of your repository [7][8][9]. - Automate generation: For Claude Code, you can run the /init command to have the agent automatically analyze your codebase and draft an initial CLAUDE.md [8][3][9]. - Multi-tool support: If your team uses multiple AI agents, you can maintain a single source of truth (e.g., AGENTS.md) and use a symbolic link to ensure other tools can read it [10][11][4]. For example, on Linux or macOS, you can run: ln -s AGENTS.md CLAUDE.md [10][11][5] 2. Hierarchy and Precedence: - Both formats support hierarchical layering, allowing you to define instructions at the global, project, and subdirectory levels [1][8][9]. - AGENTS.md (for Codex CLI): Typically follows a root-to-leaf lookup order, where the file closest to your current working directory takes precedence [1][12][13]. - CLAUDE.md (for Claude Code): Uses a layered approach (Managed policy → User → Project → Local) where files are concatenated or applied based on scope [8][9]. 3. Best Practices: - Keep instructions concise, actionable, and human-readable [2][6][9]. - Use nested files in monorepos to provide specific instructions for different sub-projects or packages [12][7][5]. - Commit project-level files to version control so they are shared across your team [8][3][9]. - Use tool-specific override files (e.g., AGENTS.override.md or CLAUDE.local.md) for personal, non-committed preferences [10][13][9].
Citations:
- 1: https://ai-tldr.dev/learn/ai-coding-tools/coding-agents-assistants/agents-md-claude-md/
- 2: https://docs.factory.ai/cli/configuration/agents-md
- 3: https://support.claude.com/en/articles/14553240-give-claude-context-claude-md-and-better-prompts
- 4: https://localskills.sh/blog/agents-md-vs-claude-md
- 5: https://self.md/concepts/agents-md/
- 6: https://claude.com/blog/using-claude-md-files
- 7: https://agents.md/
- 8: https://code.claude.com/docs/en/claude-md
- 9: https://usingclaude.com/en/claude-code/claude-md/claude-md-guide
- 10: https://codex.danielvaughan.com/2026/05/27/agent-instruction-files-agents-md-claude-md-cross-tool-portability-codex-cli/
- 11: https://benjamincrozat.com/agents-md
- 12: https://www.codegateway.dev/en/blog/agents-md-playbook-2026
- 13: https://developers.openai.com/codex/guides/agents-md
Select the active host’s directive file.
This selection should depend on the detected host. For Codex, use AGENTS.md; for Claude Code, use CLAUDE.md. Define the case where both integrations are requested.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/agent-installation.md` around lines 70 - 76, Update the directive-file
selection instructions to branch on the detected host: use AGENTS.md for Codex
and CLAUDE.md for Claude Code. Explicitly define the behavior when both
integrations are requested, while preserving existing content and appending only
missing headings.
| ## 8. Verify and Report | ||
|
|
||
| Verify: | ||
|
|
||
| - the four runtime skills are installed at project scope; | ||
| - the vault schema version and five required tables are healthy; | ||
| - `.knowledge/reports`, `.knowledge/changesets`, and `.knowledge/decisions` exist; | ||
| - all four workflows are byte-identical to their templates; | ||
| - all three active-host hook scripts exist and are executable; | ||
| - all three directive headings and ignore rules exist; and | ||
| - each managed hook command appears exactly once in the active host configuration. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Validate hook syntax and merged configuration.
The checks verify file existence, executable permissions, and command counts. They do not run bash -n on the hook scripts or parse the merged JSON configuration. tests/installation-assets.sh already performs these checks. Add them before reporting installation success.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/agent-installation.md` around lines 109 - 119, Update the verification
steps in the “Verify and Report” section to run bash -n against all three
active-host hook scripts and parse/validate the merged JSON configuration before
reporting success. Reuse the existing checks from tests/installation-assets.sh
rather than adding unrelated validation.
| "allow": [ | ||
| "Bash(*/knowledge-gate:*)", | ||
| "Bash(sqlite3 .knowledge/vault.db:*)" | ||
| ] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove the direct vault database permission.
The installation contract permits sqlite3 .knowledge/vault.db, which bypasses knowledge-gate and its vault-access policy.
plugins/knowledge-distillery/install/hooks/claude-settings.json#L3-L6: RemoveBash(sqlite3 .knowledge/vault.db:*)frompermissions.allow.tests/installation-assets.sh#L45-L46: Remove the assertion that requires the direct database permission.
As per coding guidelines, “.knowledge/**: Do not directly read files in the .knowledge/ directory.”
📍 Affects 2 files
plugins/knowledge-distillery/install/hooks/claude-settings.json#L3-L6(this comment)tests/installation-assets.sh#L45-L46
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/knowledge-distillery/install/hooks/claude-settings.json` around lines
3 - 6, Remove the direct sqlite3 vault permission from
plugins/knowledge-distillery/install/hooks/claude-settings.json, leaving only
the knowledge-gate permission. In tests/installation-assets.sh, remove the
assertion requiring that direct database permission; no other installation
permission checks need to change.
Source: Coding guidelines
| Give the coding agent either this README or the dedicated [Agent Installation Guide](docs/agent-installation.md). The guide is self-contained, so its URL can be sent directly: | ||
|
|
||
| > Install Knowledge Distillery in this repository by following https://github.com/ether-moon/knowledge-distillery/blob/main/docs/agent-installation.md. Preserve unrelated configuration and report the resulting diff and verification results. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin the installation guide URL to a reviewed revision.
Line 36 directs the agent to the mutable main branch. A future change or compromise can alter installation commands without a corresponding README change. Use a release tag or commit SHA that contains the reviewed README and guide.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 34 - 36, Update the installation instruction in the
README to reference a reviewed immutable release tag or commit SHA instead of
the mutable main branch, ensuring the pinned revision contains both the reviewed
README and agent-installation guide while preserving the existing instruction
text.
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 12
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
plugins/knowledge-distillery/install/hooks/pre-commit-memento.sh (1)
21-24: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRequire a note attachment operation before allowing the commit.
git commit -m "x"; git notes listpasses this condition and creates an undocumented commit. The PostToolUse hook only sends a reminder after the commit. Require the installed memento command shape, includinggit notes ... add, before bypassing the block. Add a regression test for an unrelatedgit notescommand.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/hooks/pre-commit-memento.sh` around lines 21 - 24, Update the command check in the pre-commit hook to bypass only the installed memento command shape containing git notes followed by the add operation, rather than any git notes command. Preserve blocking for commits paired with unrelated git notes commands, and add a regression test covering that unrelated command.
🧹 Nitpick comments (2)
plugins/knowledge-distillery/install/workflows/apply-changeset.yml (1)
57-63: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAdd a concurrency group to the apply job.
The workflow has no
concurrency:block. Two batch Report PRs that merge close together start twoapply-changesetjobs on the same base ref. Both jobs run_changeset-applyagainst.knowledge/vault.dband then push, so one push fails or one vault write is lost. Serialize the job per base ref.♻️ Proposed change
apply-changeset: if: >- github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'knowledge/batch-') runs-on: ubuntu-latest + concurrency: + group: knowledge-apply-changeset-${{ github.event.pull_request.base.ref }} + cancel-in-progress: false permissions: contents: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml` around lines 57 - 63, Add a concurrency configuration for the apply-changeset job so executions are serialized per base ref, using a group keyed by the target branch (for example, github.event.pull_request.base.ref) and preserving the existing job condition and permissions.plugins/knowledge-distillery/install/workflows/curate-report.yml (1)
9-12: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueMatch the
/curatecommand more strictly, and serialize the job.
contains(github.event.comment.body, '/curate')matches the substring anywhere in the body. A comment that quotes an earlier command, or a word such as/curated, triggers a new run. The workflow also has noconcurrency:block, so two/curatecomments produce two jobs that commit to the same branch.Match the command at the start of the body, and add a concurrency group keyed on the issue number.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/curate-report.yml` around lines 9 - 12, Update the workflow trigger condition around the existing /curate check to match only when the comment body starts with the exact /curate command, rather than matching the substring anywhere. Add a concurrency configuration for the job using the issue number as the group key so multiple /curate comments on the same issue serialize.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/agent-installation.md`:
- Around line 109-119: Update the verification steps in the “Verify and Report”
section to run bash -n against all three active-host hook scripts and
parse/validate the merged JSON configuration before reporting success. Reuse the
existing checks from tests/installation-assets.sh rather than adding unrelated
validation.
- Around line 13-24: Update the Codex and Claude Code installation instructions
to pin the remote knowledge-distillery source to an immutable tag or commit
instead of main. Revise the workflow and host-hook copy instructions to use the
same pinned revision, record that revision alongside every managed path, and
require content and configuration review for both hosts before activation.
- Around line 35-43: Expand the existing-vault validation instructions in the
installation guide to define what happens when PRAGMA user_version or any
required table check fails. Add a supported read-only health command or
explicitly permit read-only SQL inspection, then document a safe recovery path
using backup followed by migration or regeneration, and abort when recovery is
unsupported; preserve the requirement not to mutate the original vault.
- Around line 70-76: Update the directive-file selection instructions to branch
on the detected host: use AGENTS.md for Codex and CLAUDE.md for Claude Code.
Explicitly define the behavior when both integrations are requested, while
preserving existing content and appending only missing headings.
In `@plugins/knowledge-distillery/install/hooks/claude-settings.json`:
- Around line 3-6: Remove the direct sqlite3 vault permission from
plugins/knowledge-distillery/install/hooks/claude-settings.json, leaving only
the knowledge-gate permission. In tests/installation-assets.sh, remove the
assertion requiring that direct database permission; no other installation
permission checks need to change.
In `@plugins/knowledge-distillery/install/hooks/post-commit-memento.sh`:
- Around line 16-18: Update the SHA extraction after the OUTPUT assignment to
parse only Git’s commit status line rather than selecting the first hexadecimal
token anywhere in the output, so hexadecimal branch-name components cannot be
mistaken for the commit SHA. Add a regression test covering a branch name such
as feature/cafebabe and verify that the actual commit SHA is extracted.
- Around line 11-27: Update the post-commit hook’s command handling to exit
early for commit messages beginning with “decision:” before extracting SHA or
checking notes, matching the PreToolUse exception. Add a regression test
covering a decision: commit and verifying that no missing-note reminder is
emitted.
In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml`:
- Around line 132-154: Gate the “Clean up batch artifacts” step on an explicit
success output from the preceding vault commit step, so it runs only when that
commit actually succeeds. Define and propagate the commit step’s output, then
reference it in the cleanup step’s condition while preserving the existing
artifact removal and push logic.
- Around line 121-131: Update the “Commit and push vault.db” step to detect both
tracked modifications and an initially untracked .knowledge/vault.db using git
status --porcelain, while preserving the no-change early exit. After committing,
rebase onto the current github.event.pull_request.base.ref before pushing so
concurrent updates are incorporated and the push is protected.
In `@plugins/knowledge-distillery/install/workflows/batch-refine.yml`:
- Around line 47-51: Update
plugins/knowledge-distillery/install/workflows/batch-refine.yml lines 47-51 by
binding LINEAR_API_KEY, SLACK_API_KEY, NOTION_API_KEY, and the MCP GITHUB_TOKEN
through the step env block, then mask and serialize those environment variables
with jq rather than interpolating secrets into shell or JSON. Apply the same
change in plugins/knowledge-distillery/install/workflows/mark-evidence.yml line
33 for LINEAR_API_KEY and the MCP GITHUB_TOKEN; both workflows must safely
handle secret values containing shell or JSON metacharacters.
- Around line 55-62: Update the github MCP Authorization header in
plugins/knowledge-distillery/install/workflows/batch-refine.yml:55-62,
curate-report.yml:60-67, and mark-evidence.yml:37-44 to use a supported PAT or
GitHub App token secret instead of secrets.GITHUB_TOKEN. Add
installation/configuration documentation naming the required secret and token
scope, or implement stateless token support if that is the chosen approach.
In `@README.md`:
- Around line 34-36: Update the installation instruction in the README to
reference a reviewed immutable release tag or commit SHA instead of the mutable
main branch, ensuring the pinned revision contains both the reviewed README and
agent-installation guide while preserving the existing instruction text.
---
Outside diff comments:
In `@plugins/knowledge-distillery/install/hooks/pre-commit-memento.sh`:
- Around line 21-24: Update the command check in the pre-commit hook to bypass
only the installed memento command shape containing git notes followed by the
add operation, rather than any git notes command. Preserve blocking for commits
paired with unrelated git notes commands, and add a regression test covering
that unrelated command.
---
Nitpick comments:
In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml`:
- Around line 57-63: Add a concurrency configuration for the apply-changeset job
so executions are serialized per base ref, using a group keyed by the target
branch (for example, github.event.pull_request.base.ref) and preserving the
existing job condition and permissions.
In `@plugins/knowledge-distillery/install/workflows/curate-report.yml`:
- Around line 9-12: Update the workflow trigger condition around the existing
/curate check to match only when the comment body starts with the exact /curate
command, rather than matching the substring anywhere. Add a concurrency
configuration for the job using the issue number as the group key so multiple
/curate comments on the same issue serialize.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ade9abc5-59e1-4292-b980-b23117744b9b
📒 Files selected for processing (32)
.knowledge/decisions/2026-07-31-linked-agent-installation-contract.md.knowledge/decisions/2026-07-31-llm-led-selective-installation.md.knowledge/decisions/2026-07-31-readme-replaces-setup-skill.mdREADME.mddocs/adoption-guide.mddocs/agent-installation.mddocs/design-implementation.mddocs/ko/README.mddocs/ko/adoption-guide.mddocs/ko/design-implementation.mddocs/ko/tool-evaluation.mddocs/tool-evaluation.mdplugins/knowledge-distillery/install/hooks/claude-settings.jsonplugins/knowledge-distillery/install/hooks/codex-hooks.jsonplugins/knowledge-distillery/install/hooks/post-commit-memento.shplugins/knowledge-distillery/install/hooks/pre-commit-memento.shplugins/knowledge-distillery/install/hooks/pre-prompt-knowledge-gate.shplugins/knowledge-distillery/install/workflows/apply-changeset.ymlplugins/knowledge-distillery/install/workflows/batch-refine.ymlplugins/knowledge-distillery/install/workflows/curate-report.ymlplugins/knowledge-distillery/install/workflows/mark-evidence.ymlplugins/knowledge-distillery/skills/memento-commit/SKILL.mdplugins/knowledge-distillery/skills/record-decision/SKILL.mdplugins/knowledge-distillery/skills/setup/SKILL.mdplugins/knowledge-distillery/skills/setup/scripts/install-hookstests/all.shtests/batch-refine-orchestration.shtests/fixtures/orchestration/batch-refine.jsontests/installation-assets.shtests/prompt-contracts.shtests/setup-hooks.shtests/skill-packaging.sh
💤 Files with no reviewable changes (3)
- tests/setup-hooks.sh
- plugins/knowledge-distillery/skills/setup/SKILL.md
- plugins/knowledge-distillery/skills/setup/scripts/install-hooks
🛑 Comments failed to post (6)
plugins/knowledge-distillery/install/hooks/post-commit-memento.sh (2)
11-27: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Skip approved decision commits.
The PreToolUse hook permits
decision:commits without memento notes. This hook still emits a missing-note reminder after those commits. Apply the same decision-message exception before the SHA and note checks. Add a regression test for adecision:commit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/hooks/post-commit-memento.sh` around lines 11 - 27, Update the post-commit hook’s command handling to exit early for commit messages beginning with “decision:” before extracting SHA or checking notes, matching the PreToolUse exception. Add a regression test covering a decision: commit and verifying that no missing-note reminder is emitted.
16-18: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Extract the commit SHA from the commit status line.
Line 18 selects the first hexadecimal token in the output. A branch such as
feature/cafebabecan be selected before the actual commit SHA. Parse the SHA from Git’s commit status line, then add a regression test with a hexadecimal branch-name component.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/hooks/post-commit-memento.sh` around lines 16 - 18, Update the SHA extraction after the OUTPUT assignment to parse only Git’s commit status line rather than selecting the first hexadecimal token anywhere in the output, so hexadecimal branch-name components cannot be mistaken for the commit SHA. Add a regression test covering a branch name such as feature/cafebabe and verify that the actual commit SHA is extracted.plugins/knowledge-distillery/install/workflows/apply-changeset.yml (2)
121-131: 🗄️ Data Integrity & Integration | 🔴 Critical | 🏗️ Heavy lift
Commit vault.db even when it is untracked, and protect the push.
git diff --quiet .knowledge/vault.dbcompares the worktree to the index for tracked paths only. If_changeset-applycreates.knowledge/vault.dbfor the first time, the path is untracked,git diff --quietexits 0, and the step exits without committing. The applied entries are lost, and the cleanup step at Lines 132-154 still deletes the changeset and the report, so the batch cannot be replayed.The push also has no rebase or retry, while the cleanup step at Line 152 rebases before pushing. A concurrent merge to the same base ref fails this step after
_changeset-applyalready mutated the vault.Use
git status --porcelainfor the change check, and rebase before pushing.🛠️ Proposed fix
- name: Commit and push vault.db run: | - if git diff --quiet .knowledge/vault.db 2>/dev/null; then + if [ -z "$(git status --porcelain -- .knowledge/vault.db)" ]; then echo "No vault.db changes — skipping commit" exit 0 fi git add .knowledge/vault.db git commit -m "knowledge: apply batch ${{ steps.batch.outputs.date }} changeset" + git pull --rebase origin ${{ github.event.pull_request.base.ref }} git push origin ${{ github.event.pull_request.base.ref }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.- name: Commit and push vault.db run: | if [ -z "$(git status --porcelain -- .knowledge/vault.db)" ]; then echo "No vault.db changes — skipping commit" exit 0 fi git add .knowledge/vault.db git commit -m "knowledge: apply batch ${{ steps.batch.outputs.date }} changeset" git pull --rebase origin ${{ github.event.pull_request.base.ref }} git push origin ${{ github.event.pull_request.base.ref }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml` around lines 121 - 131, Update the “Commit and push vault.db” step to detect both tracked modifications and an initially untracked .knowledge/vault.db using git status --porcelain, while preserving the no-change early exit. After committing, rebase onto the current github.event.pull_request.base.ref before pushing so concurrent updates are incorporated and the push is protected.
132-154: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Clean up only after the vault commit succeeds.
The cleanup step runs even when the previous step skipped the commit. Combined with the untracked-file gap reported on Lines 121-131, the changeset and the report can be deleted while the vault never received the entries. Gate this step on an explicit output from the commit step.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/apply-changeset.yml` around lines 132 - 154, Gate the “Clean up batch artifacts” step on an explicit success output from the preceding vault commit step, so it runs only when that commit actually succeeds. Define and propagate the commit step’s output, then reference it in the cleanup step’s condition while preserving the existing artifact removal and push logic.plugins/knowledge-distillery/install/workflows/batch-refine.yml (2)
47-51: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Secrets are substituted into shell scripts and JSON literals in both installed workflows. Actions expands
${{ secrets.* }}into the script text before bash runs, so a value containing a quote, a backtick,$(, or\changes the executed command and can also produce invalid.mcp.json. Bind secrets toenv:and build the JSON withjq.
plugins/knowledge-distillery/install/workflows/batch-refine.yml#L47-L51: moveLINEAR_API_KEY,SLACK_API_KEY,NOTION_API_KEY, and the MCPGITHUB_TOKENinto anenv:block, then mask and serialize from those variables.plugins/knowledge-distillery/install/workflows/mark-evidence.yml#L33-L33: moveLINEAR_API_KEYand the MCPGITHUB_TOKENinto anenv:block and apply the same masking and serialization.📍 Affects 2 files
plugins/knowledge-distillery/install/workflows/batch-refine.yml#L47-L51(this comment)plugins/knowledge-distillery/install/workflows/mark-evidence.yml#L33-L33🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/batch-refine.yml` around lines 47 - 51, Update plugins/knowledge-distillery/install/workflows/batch-refine.yml lines 47-51 by binding LINEAR_API_KEY, SLACK_API_KEY, NOTION_API_KEY, and the MCP GITHUB_TOKEN through the step env block, then mask and serialize those environment variables with jq rather than interpolating secrets into shell or JSON. Apply the same change in plugins/knowledge-distillery/install/workflows/mark-evidence.yml line 33 for LINEAR_API_KEY and the MCP GITHUB_TOKEN; both workflows must safely handle secret values containing shell or JSON metacharacters.
55-62: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
GitHub remote MCP server api.githubcopilot.com installation access token ghs_ rejected 2026💡 Result:
The "ghs_" token (GitHub App installation token) is likely being rejected by your GitHub remote MCP server configuration because the server or the client implementation is either not designed to accept this token type or is using outdated validation logic that blocks it [1][2]. As of 2026, GitHub has updated the format of "ghs_" tokens to be longer and contain a JWT component [3][4]. While these tokens are now standard for many GitHub App server-to-server interactions (including GitHub Actions), they are frequently incompatible with older client-side software that expects specific token formats (like traditional PATs starting with "ghp_" or OAuth tokens starting with "gho_" / "ghu_") [1][2]. To resolve this issue: 1. Confirm Token Compatibility: The GitHub Remote MCP server primarily supports OAuth tokens or fine-grained Personal Access Tokens (PATs) for user-to-server authentication [5][2]. If you are using a "ghs_" token generated by a GitHub App or GitHub Actions (
GITHUB_TOKEN), this is likely the root cause of the rejection [2]. 2. Use Authorized Credentials: If you are setting up the MCP server for personal use in an IDE (e.g., VS Code, Cursor), use an OAuth-based flow or a personal access token (PAT) instead [6][7]. - OAuth: Use the built-in authentication flow provided by your IDE's MCP client [6][8]. - PAT: If using a PAT, ensure it has the necessary scopes for the GitHub resources you intend to access [5]. 3. Check Client Configuration: Ensure your client's MCP configuration (e.g.,mcp.jsonor equivalent) uses the correct URL:https://api.githubcopilot.com/mcp[9]. Note that usinghttps://api.githubcopilot.com/mcp/(with a trailing slash) has been known to cause authentication issues in some environments [9]. 4. Verify Licensing: Ensure your GitHub account has an active Copilot license, as some endpoints in the remote MCP server may return a 403 Forbidden error if a valid license is not detected [10][1]. If you are a developer integrating these tokens programmatically, verify if your environment supports the new stateless "ghs_" token format; if not, you may need to update the client or, if applicable, set feature flags or environment variables (such asS2STOKENS: truein specific automation contexts) that explicitly permit these token types [3][2].Citations:
- 1: github/github-mcp-server#598
- 2: github/gh-aw#18028
- 3: https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/
- 4: https://github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens/
- 5: https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp-in-your-ide/use-the-github-mcp-server
- 6: https://github.blog/ai-and-ml/generative-ai/a-practical-guide-on-how-to-use-the-github-mcp-server/
- 7: https://github.com/Github/github-mcp-server
- 8: https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp-in-your-ide/extend-copilot-chat-with-mcp
- 9: github/github-mcp-server#804
- 10: github/github-mcp-server#672
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Repository files for workflow manifests:\n' git ls-files 'plugins/knowledge-distillery/install/workflows/*.yml' | sort printf '\nRelevant workflow snippets:\n' for f in plugins/knowledge-distillery/install/workflows/batch-refine.yml \ plugins/knowledge-distillery/install/workflows/curate-report.yml \ plugins/knowledge-distillery/install/workflows/mark-evidence.yml; do echo "--- $f ---" nl -ba "$f" | sed -n '1,120p' done printf '\nSearch for GITHUB_TOKEN and GitHub Copilot MCP secrets in plugin:\n' rg -n 'GITHUB_TOKEN|githubcopilot|api\.githubcopilot\.com|mcp|Personal Access Token|PAT|installation guide|INSTALL|README|README\.md|workflow' plugins/knowledge-distillery/install -S || trueRepository: ether-moon/knowledge-distillery
Length of output: 613
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Current repository root files:\n' for f in plugins/knowledge-distillery/install/workflows/batch-refine.yml \ plugins/knowledge-distillery/install/workflows/curate-report.yml \ plugins/knowledge-distillery/install/workflows/mark-evidence.yml; do printf '\n--- $f ---\n' cat -n "$f" | sed -n '1,120p' done printf '\nSearch for token/copilot documentation references:\n' rg -n 'GITHUB_TOKEN|githubcopilot|api\.githubcopilot\.com|mcp__github|mCP|MCP|Personal Access Token|PAT|installation guide|docs|README|Setup|Installation' plugins/knowledge-distillery/install plugins/knowledge-distillery -S || trueRepository: ether-moon/knowledge-distillery
Length of output: 45247
🌐 Web query:
site:docs.github.com/copilot github MCP server API githubcopilot.com installation access token personal access token OAuth💡 Result:
The GitHub Model Context Protocol (MCP) server allows integration with various data sources and tools, including those used within GitHub Copilot [1]. Regarding access and authentication for the GitHub MCP server, organization-level policies are managed via the GitHub MCP Server repository documentation rather than through standard GitHub Copilot settings [2]. While specific installation steps for the GitHub MCP server depend on the host application (such as Cursor, Windsurf, or Claude) [2], authentication typically requires a GitHub Personal Access Token (PAT) with appropriate scopes to allow the server to interface with your GitHub resources. You should configure these credentials within the environment variables or configuration files designated by your specific MCP client or host application. To manage access for your organization, use the GitHub REST API to grant Copilot access to teams or specific users [3]. Note that while the Copilot CLI can utilize MCP servers, it does not currently support certain organization-level policies related to enabling or restricting MCP servers [1]. For detailed configuration requirements and authentication scopes, refer to the Policies and Governance documentation found in the official GitHub MCP Server repository [2].
Citations:
- 1: https://docs.github.com/copilot/concepts/agents/about-copilot-cli
- 2: https://docs.github.com/copilot/managing-github-copilot-in-your-organization/managing-policies-and-features-for-copilot-in-your-organization
- 3: https://docs.github.com/copilot/managing-github-copilot-in-your-organization/granting-access-to-copilot-for-members-of-your-organization
Use a supported GitHub MCP credential for every workflow. The installed workflows write
.mcp.jsonwithAuthorization: Bearer ${{ secrets.GITHUB_TOKEN }}, butGITHUB_TOKENis an installation access token and the remote Copilot MCP endpoint is configured for GitHub App, PAT, or OAuth credentials instead. If installation tokens are rejected, everymcp__github__*call can fail at connection time in these workflows.
plugins/knowledge-distillery/install/workflows/batch-refine.yml,curate-report.yml, andmark-evidence.yml: use a PAT/GHA app token secret in thegithubMCPAuthorizationheader or add stateless token support.- Add installation/config docs for the required token scope and secret name.
📍 Affects 3 files
plugins/knowledge-distillery/install/workflows/batch-refine.yml#L55-L62(this comment)plugins/knowledge-distillery/install/workflows/curate-report.yml#L60-L67plugins/knowledge-distillery/install/workflows/mark-evidence.yml#L37-L44🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/knowledge-distillery/install/workflows/batch-refine.yml` around lines 55 - 62, Update the github MCP Authorization header in plugins/knowledge-distillery/install/workflows/batch-refine.yml:55-62, curate-report.yml:60-67, and mark-evidence.yml:37-44 to use a supported PAT or GitHub App token secret instead of secrets.GITHUB_TOKEN. Add installation/configuration documentation naming the required secret and token scope, or implement stateless token support if that is the chosen approach.
1 participant
Summary
setupskill with a linked installation contract that an LLM coding agent can executenpx skills addplugins/knowledge-distillery/install/Test plan
bash tests/all.shgit diff --checkSummary by CodeRabbit
New Features
Documentation
Tests