Repository navigation
docs(connect): shorten the /connect guide and keep text out of shell source - #144
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 48 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Preview deployed!
This is a Cloudflare Workers preview version of this PR's build. |
Four steps (install, join or create, talk, finish) plus a short failure list. create passes --task through a quoted here-document and send reads the message from one, so apostrophes and shell syntax are passed literally; finish presents end (host) and leave (guest) as alternatives. Adds the Codex-on-macOS sandbox note found during the end-to-end proof. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
0e57c22 to
58a242d
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
khaliqgant
changed the title
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58a242de76
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…source A here-document closes early if the text contains its marker line, which can run the following lines as shell. Agents now write the task or message with their file-editing tool and pass it as --task "$(cat file)" or on stdin with < file; a file's contents are never parsed. Here-documents remain a fallback only with a marker absent from the text. Verified in sh and zsh with lines matching the old markers plus $(), backtick and quote-breakout payloads: all passed literally, nothing executed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
…allback - Tell the agent to write /tmp/relay-task.txt before showing the create command, so a top-down read never runs create with an empty task. - Restore: never send share_text to another person unless asked. - Show the quoted here-document fallback for send, with a fresh random marker the text must not contain. - "No relay process starts" instead of "Nothing runs": the installer executes the probe to verify it. - Pin the file-based create --task form and the step order in tests. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8d4a3f7. Configure here.
… text Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1 participant
Shortens the
/connectagent guide that #141 shipped to four steps (install, join or create, talk, finish), plus a short "if something fails" list.--task "$(cat /tmp/relay-task.txt)"or sends with< /tmp/relay-message.txt. A file's contents are never parsed as shell. The previousprintf '%s' '…'example put the message into shell source (flagged by skills#138's reviewers), and a here-document closes early on its marker line (Devin, on this PR). Here-documents remain a fallback only, with a random marker absent from the text. Verified in sh and zsh with hostile input, including lines exactly matching the old markers: nothing executed.end(host, also removes its own session) andleave(guest) are alternatives. Running leave first made the host'sendfail and left the room open.The guide test also pins the
< fileform and the absence ofprintf '%s' 'andARELAY_TASK. Tests:connect-guideplusconnect-install, 21/21.Companion: AgentWorkforce/skills#138 (the
relay-connectskill now uses the same command forms).🤖 Generated with Claude Code
Note
Low Risk
Documentation and test-only changes to the Connect agent guide; no runtime application logic or security-sensitive code paths.
Overview
Rewrites the
/connectagent markdown guide into four steps (install → join/create → talk → finish) plus a short “If something fails” section, with tighter intro copy and clearer permission boundaries for agents.Shell safety is the main behavioral change in the instructions: agents must write task and message text with a file-editing tool, then use
--task "$(cat /tmp/relay-task.txt)"andconnect send … < /tmp/relay-message.txtinstead of embedding user text in the command or the oldprintf '%s' '…'pipe. Here-documents stay as a fallback only, with guidance to use a random marker that must not appear in the message.Finish now separates host
end(closes the room for everyone; do notleavefirst) from guestleave, documents Codex on macOS sandbox failures and escalated permissions, and trims other installer/probe detail into the troubleshooting list.connect-guide.test.tsexpands assertions to require the new command forms,send/status/leave, noprintf '%s' ', no inline quoted--task, and ordering of task-file instructions beforecreate.Reviewed by Cursor Bugbot for commit 72b2eb6. Bugbot is set up for automated code reviews on this repo. Configure here.