Repository navigation
Add persona packs (autonomous-actor, nango-integrations) + private autonomous-run prpm collection - #184
Conversation
|
CodeAnt AI is reviewing your PR. |
|
Warning Review limit reached
More reviews will be available in 13 minutes and 17 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (16)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
There was a problem hiding this comment.
6 issues found across 20 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".agentworkforce/workforce/scripts/validate-personas.mjs">
<violation number="1" location=".agentworkforce/workforce/scripts/validate-personas.mjs:16">
P1: `files` validation is too permissive and can miss accidental publication of private directories (e.g. `skills/`).</violation>
</file>
<file name=".agentworkforce/workforce/package.json">
<violation number="1" location=".agentworkforce/workforce/package.json:3">
P2: Missing `"license"` field in `package.json`. This public npm-scoped package will be published to the registry, but it does not declare a license. `npm publish` warns about missing licenses, and consumers have no machine-readable indication of usage terms. Add `"license": "Apache-2.0"` (matching the repo root) before publishing.</violation>
</file>
<file name=".agentworkforce/workforce/personas/nango-integrations.json">
<violation number="1" location=".agentworkforce/workforce/personas/nango-integrations.json:35">
P0: `dangerouslyBypassApprovalsAndSandbox: true` on a persona that handles production credentials (`NANGO_PRODUCTION_KEY`), runs production-environment commands (`-e production`), executes arbitrary scripts, and opens cross-repo PRs — with only `reasoning: "medium"` as the sole compensating control. This is a significant security concern: the agent can execute arbitrary commands against production environments and sibling repos without any approval gate or sandbox. No other persona in this repository uses this setting.</violation>
</file>
<file name=".github/workflows/publish-persona-packs.yml">
<violation number="1" location=".github/workflows/publish-persona-packs.yml:225">
P2: The final push step is skipped on prior failure, which can leave successful publishes without pushed commit/tag metadata.</violation>
</file>
<file name="prpm.json">
<violation number="1" location="prpm.json:12">
P1: Package names in the `packages` array don't match the `packageId` values in the collection. Every collection entry uses `@agent-relay/<name>` but the corresponding package definitions use `<name>` without the scope. The collection will fail to resolve its constituent packages.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| "harnessSettings": { | ||
| "reasoning": "medium", | ||
| "timeoutSeconds": 900, | ||
| "dangerouslyBypassApprovalsAndSandbox": true |
There was a problem hiding this comment.
P0: dangerouslyBypassApprovalsAndSandbox: true on a persona that handles production credentials (NANGO_PRODUCTION_KEY), runs production-environment commands (-e production), executes arbitrary scripts, and opens cross-repo PRs — with only reasoning: "medium" as the sole compensating control. This is a significant security concern: the agent can execute arbitrary commands against production environments and sibling repos without any approval gate or sandbox. No other persona in this repository uses this setting.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .agentworkforce/workforce/personas/nango-integrations.json, line 35:
<comment>`dangerouslyBypassApprovalsAndSandbox: true` on a persona that handles production credentials (`NANGO_PRODUCTION_KEY`), runs production-environment commands (`-e production`), executes arbitrary scripts, and opens cross-repo PRs — with only `reasoning: "medium"` as the sole compensating control. This is a significant security concern: the agent can execute arbitrary commands against production environments and sibling repos without any approval gate or sandbox. No other persona in this repository uses this setting.</comment>
<file context>
@@ -0,0 +1,37 @@
+ "harnessSettings": {
+ "reasoning": "medium",
+ "timeoutSeconds": 900,
+ "dangerouslyBypassApprovalsAndSandbox": true
+ }
+}
</file context>
| errors.push('package.json must declare agentworkforce.personas as "personas"'); | ||
| } | ||
|
|
||
| if (!Array.isArray(packageJson.files) || !packageJson.files.includes('personas')) { |
There was a problem hiding this comment.
P1: files validation is too permissive and can miss accidental publication of private directories (e.g. skills/).
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .agentworkforce/workforce/scripts/validate-personas.mjs, line 16:
<comment>`files` validation is too permissive and can miss accidental publication of private directories (e.g. `skills/`).</comment>
<file context>
@@ -0,0 +1,126 @@
+ errors.push('package.json must declare agentworkforce.personas as "personas"');
+}
+
+if (!Array.isArray(packageJson.files) || !packageJson.files.includes('personas')) {
+ errors.push('package.json files must include "personas"');
+}
</file context>
| "repository": "https://github.com/AgentWorkforce/workforce", | ||
| "packages": [ | ||
| { | ||
| "name": "autonomous-run-contract", |
There was a problem hiding this comment.
P1: Package names in the packages array don't match the packageId values in the collection. Every collection entry uses @agent-relay/<name> but the corresponding package definitions use <name> without the scope. The collection will fail to resolve its constituent packages.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At prpm.json, line 12:
<comment>Package names in the `packages` array don't match the `packageId` values in the collection. Every collection entry uses `@agent-relay/<name>` but the corresponding package definitions use `<name>` without the scope. The collection will fail to resolve its constituent packages.</comment>
<file context>
@@ -0,0 +1,175 @@
+ "repository": "https://github.com/AgentWorkforce/workforce",
+ "packages": [
+ {
+ "name": "autonomous-run-contract",
+ "version": "1.0.1",
+ "description": "Use at the start of every autonomous, multi-PR, cutover-class delegated run. Authors the binding contract between operator and agent: gates, flip mechanism, rollback triggers, standing constraints, cross-repo authority, and explicit escalate-to-human conditions.",
</file context>
| @@ -0,0 +1,34 @@ | |||
| { | |||
| "name": "@agentworkforce/personas-workforce", | |||
| "version": "0.1.0", | |||
There was a problem hiding this comment.
P2: Missing "license" field in package.json. This public npm-scoped package will be published to the registry, but it does not declare a license. npm publish warns about missing licenses, and consumers have no machine-readable indication of usage terms. Add "license": "Apache-2.0" (matching the repo root) before publishing.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .agentworkforce/workforce/package.json, line 3:
<comment>Missing `"license"` field in `package.json`. This public npm-scoped package will be published to the registry, but it does not declare a license. `npm publish` warns about missing licenses, and consumers have no machine-readable indication of usage terms. Add `"license": "Apache-2.0"` (matching the repo root) before publishing.</comment>
<file context>
@@ -0,0 +1,34 @@
+{
+ "name": "@agentworkforce/personas-workforce",
+ "version": "0.1.0",
+ "private": false,
+ "type": "module",
</file context>
| done | ||
|
|
||
| - name: Push commits + tags | ||
| if: ${{ github.event.inputs.dry_run != 'true' && (github.event.inputs.version != 'none' || github.event.inputs.custom_version != '') }} |
There was a problem hiding this comment.
P2: The final push step is skipped on prior failure, which can leave successful publishes without pushed commit/tag metadata.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/publish-persona-packs.yml, line 225:
<comment>The final push step is skipped on prior failure, which can leave successful publishes without pushed commit/tag metadata.</comment>
<file context>
@@ -0,0 +1,226 @@
+ done
+
+ - name: Push commits + tags
+ if: ${{ github.event.inputs.dry_run != 'true' && (github.event.inputs.version != 'none' || github.event.inputs.custom_version != '') }}
+ run: git push origin HEAD --follow-tags
</file context>
| for (const field of ['harness', 'model']) { | ||
| if (typeof persona[field] !== 'string' || persona[field].trim() === '') { | ||
| errors.push(`${rel}.${field} must be a non-empty string`); | ||
| } |
There was a problem hiding this comment.
Suggestion: This unconditionally requires harness and model, but handler personas with onEvent are allowed to omit these fields by the canonical parser contract. That means this validator can reject valid personas and block packaging/publishing for supported persona shapes. Make these checks conditional on whether the persona is interactive vs handler-style. [incorrect condition logic]
Severity Level: Major ⚠️
- ❌ Handler personas without harness/model cannot pass personas-workforce lint.
- ⚠️ Blocks packaging valid orchestrator personas intended for cloud deploy.Steps of Reproduction ✅
1. Create a handler-style persona JSON at
`.agentworkforce/workforce/personas/orchestrator.json` with fields `id`, `intent:
"documentation"`, `tags`, `description`, valid `harnessSettings`, `cloud: true`, valid
`integrations`, and `onEvent: "./agent.ts"`, but deliberately omit both `harness` and
`model` to follow the handler contract documented in
`packages/persona-kit/src/parse.test.ts:168–188` (handler personas may omit these).
2. Run `pnpm --filter @agentworkforce/personas-workforce lint`, which invokes
`.agentworkforce/workforce/scripts/validate-personas.mjs` (see
`.agentworkforce/workforce/package.json:27–33`).
3. During validation, the loop at `validate-personas.mjs:74–77` iterates over `['harness',
'model']` and requires each `persona[field]` to be a non-empty string; because
`orchestrator.json` omits both, the script pushes errors `${rel}.harness must be a
non-empty string` and `${rel}.model must be a non-empty string`, causing the lint/test run
to fail even though the persona shape is allowed by the canonical parser.
4. If the same `orchestrator.json` is fed to runtime tooling that uses `parsePersonaSpec`
(e.g. `preflightPersona` in `packages/deploy/src/preflight.ts:28–51` or
`compilePersonaFile` in `packages/cli/src/persona-compile.ts:13–30`), the parser's
handler-mode logic at `packages/persona-kit/src/parse.ts:329–357, 373–380, 381–28, 1–3`
recognizes `onEvent` as set (`isHandlerPersona === true`) and, per tests in
`packages/persona-kit/src/parse.test.ts:145–188`, accepts the persona with `harness` and
`model` omitted, demonstrating that `validate-personas.mjs` is over-restrictive compared
to the runtime contract.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** .agentworkforce/workforce/scripts/validate-personas.mjs
**Line:** 74:77
**Comment:**
*Incorrect Condition Logic: This unconditionally requires `harness` and `model`, but handler personas with `onEvent` are allowed to omit these fields by the canonical parser contract. That means this validator can reject valid personas and block packaging/publishing for supported persona shapes. Make these checks conditional on whether the persona is interactive vs handler-style.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| // systemPrompt may be empty for harnesses that drive via *MdContent (e.g. the | ||
| // codex nango-integrations persona), so only require it to be a string. | ||
| if (typeof persona.systemPrompt !== 'string') { | ||
| errors.push(`${rel}.systemPrompt must be a string`); | ||
| } |
There was a problem hiding this comment.
Suggestion: This allows an empty systemPrompt string, but the shared parser (parsePersonaSpec) rejects empty/whitespace systemPrompt for interactive personas. As a result, lint/test can pass here and the persona will still fail at runtime when parsed/loaded. Align this rule with the parser contract (or make it conditional only for valid handler persona cases). [api mismatch]
Severity Level: Major ⚠️
- ❌ Deploy preflight rejects personas systemPrompt empty despite passing lint.
- ⚠️ Authors get green lint but runtime parser still fails.Steps of Reproduction ✅
1. In `.agentworkforce/workforce/personas/interactive-empty-systemprompt.json`, define a
persona with `intent: "documentation"`, valid `harnessSettings`, and no `onEvent`
(interactive persona); set `systemPrompt` to `" "` (whitespace only) while keeping
`harness` and `model` valid.
2. From the repo root, run `pnpm --filter @agentworkforce/personas-workforce lint`, which
executes `.agentworkforce/workforce/package.json` scripts.lint → `node
scripts/validate-personas.mjs` (file
`.agentworkforce/workforce/scripts/validate-personas.mjs`, lines 1–32).
3. In `validate-personas.mjs`, the check at lines 79–83 only verifies `typeof
persona.systemPrompt === 'string'` and does not trim or forbid empties, so the whitespace
`systemPrompt` in `interactive-empty-systemprompt.json` passes without adding any error.
4. Later, when the same persona JSON is used with the canonical parser (e.g. via
`preflightPersona` in `packages/deploy/src/preflight.ts:28–51` or `compilePersonaFile` in
`packages/cli/src/persona-compile.ts:13–30`), `parsePersonaSpec` from
`packages/persona-kit/src/parse.ts:306–327, 329–337, 359–367, 372–380, 381–28` is invoked;
its logic at lines 21–28 (file `parse.ts`: 1018–1027 in the tool output) trims
`systemPrompt` and throws `persona[documentation].systemPrompt must be a non-empty string`
for empty/whitespace values, as also asserted in
`packages/persona-kit/src/parse.test.ts:130–142`, so runtime parsing fails even though the
personas-workforce `lint`/`test` previously succeeded.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** .agentworkforce/workforce/scripts/validate-personas.mjs
**Line:** 79:83
**Comment:**
*Api Mismatch: This allows an empty `systemPrompt` string, but the shared parser (`parsePersonaSpec`) rejects empty/whitespace `systemPrompt` for interactive personas. As a result, `lint`/`test` can pass here and the persona will still fail at runtime when parsed/loaded. Align this rule with the parser contract (or make it conditional only for valid handler persona cases).
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| if (!isObject(persona.harnessSettings)) { | ||
| errors.push(`${rel}.harnessSettings must be an object`); | ||
| } |
There was a problem hiding this comment.
Suggestion: This only checks that harnessSettings is an object, but does not validate required subfields like reasoning and positive timeoutSeconds. Invalid configs can pass this validator and still crash later when parsed by shared persona-kit validation. Reuse shared parsing/validation here or enforce the same nested rules. [incomplete implementation]
Severity Level: Major ⚠️
- ❌ Invalid harnessSettings shapes crash when parsed despite local success.
- ⚠️ CI lint misses misconfigured timeouts or reasoning levels.Steps of Reproduction ✅
1. Author a persona JSON under
`.agentworkforce/workforce/personas/invalid-harness-settings.json` with valid `id`,
`intent`, `tags`, `description`, `harness`, `model`, and `systemPrompt`, but set
`harnessSettings` to an object with invalid fields, e.g. `{ \"reasoning\": \"turbo\",
\"timeoutSeconds\": 0 }`, which is known-bad per
`packages/persona-kit/src/parse.test.ts:120–127`.
2. Execute `pnpm --filter @agentworkforce/personas-workforce lint`, invoking
`.agentworkforce/workforce/scripts/validate-personas.mjs` as defined in
`.agentworkforce/workforce/package.json:27–33`.
3. Inside `validate-personas.mjs`, the only check on `harnessSettings` is at lines 84–86
(`if (!isObject(persona.harnessSettings)) { ... }`), so any object — including `{
reasoning: "turbo", timeoutSeconds: 0 }` — satisfies `isObject(...)` and produces no
validation error; `lint`/`test` therefore pass despite the malformed settings.
4. When the same persona is consumed through runtime paths that call `parsePersonaSpec`
(e.g. deploy preflight in `packages/deploy/src/preflight.ts:28–51`, CLI compile in
`packages/cli/src/persona-compile.ts:13–30`, or built-in catalog parsing in
`packages/workload-router/src/index.ts:74–77`), the parser delegates to
`parseHarnessSettings` (`packages/persona-kit/src/parse.ts:139–208`), which requires
`reasoning` to be `'low' | 'medium' | 'high'` and `timeoutSeconds` to be a positive finite
number; as asserted in `parse.test.ts:120–127`, it throws
`persona[documentation].harnessSettings.reasoning must be low|medium|high`, causing
runtime failure even though the personas-workforce validator signaled success.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** .agentworkforce/workforce/scripts/validate-personas.mjs
**Line:** 84:86
**Comment:**
*Incomplete Implementation: This only checks that `harnessSettings` is an object, but does not validate required subfields like `reasoning` and positive `timeoutSeconds`. Invalid configs can pass this validator and still crash later when parsed by shared persona-kit validation. Reuse shared parsing/validation here or enforce the same nested rules.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
Reviewed and fixed PR #184 locally. Changes made:
Validation run:
|
|
CodeAnt AI finished reviewing your PR. |
There was a problem hiding this comment.
1 issue found across 5 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".agentworkforce/workforce/package.json">
<violation number="1" location=".agentworkforce/workforce/package.json:9">
P3: Adding `"scripts"` to the `files` array contradicts the PR's stated packaging goal of shipping "only personas/ plus README, package.json, and LICENSE." The `scripts/validate-personas.mjs` file is a development/validation tool that consumers don't need — it adds unnecessary bloat to the public tarball. This is inconsistent with the declared intent and the principle that "the published pack must stay small."</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| "description": "AgentWorkforce first-party persona pack: the autonomous-actor cutover orchestrator and the nango-integrations builder. Install with `agentworkforce install`.", | ||
| "files": [ | ||
| "personas", | ||
| "scripts", |
There was a problem hiding this comment.
P3: Adding "scripts" to the files array contradicts the PR's stated packaging goal of shipping "only personas/ plus README, package.json, and LICENSE." The scripts/validate-personas.mjs file is a development/validation tool that consumers don't need — it adds unnecessary bloat to the public tarball. This is inconsistent with the declared intent and the principle that "the published pack must stay small."
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .agentworkforce/workforce/package.json, line 9:
<comment>Adding `"scripts"` to the `files` array contradicts the PR's stated packaging goal of shipping "only personas/ plus README, package.json, and LICENSE." The `scripts/validate-personas.mjs` file is a development/validation tool that consumers don't need — it adds unnecessary bloat to the public tarball. This is inconsistent with the declared intent and the principle that "the published pack must stay small."</comment>
<file context>
@@ -6,6 +6,7 @@
"description": "AgentWorkforce first-party persona pack: the autonomous-actor cutover orchestrator and the nango-integrations builder. Install with `agentworkforce install`.",
"files": [
"personas",
+ "scripts",
"README.md",
"package.json"
</file context>
…nomous-run prpm Move the autonomous-actor and nango-integrations personas into workforce as per-persona npm packs (mirroring the relayfile-adapters layout), plus the private autonomous-run skill collection. - packages/persona-autonomous-actor: new @agentworkforce/persona-autonomous-actor pack (claude harness, model claude-opus-4-6, @agent-relay remote skills). - packages/persona-nango-integrations: @agentworkforce/persona-nango-integrations moved verbatim from relayfile-adapters (name + v0.1.6 unchanged). - .agentworkforce/workforce/personas/autonomous-actor.json: overridden loader copy with the remote-skill refs. - .agentworkforce/workforce/skills/autonomous-run-contract/SKILL.md: add NEVER STOP + cross-repo standing constraints. - prpm.json: repo-root manifest (workforce-skills) publishing the six autonomous-run skills with the private autonomous-run-private collection inline. - .github/workflows/publish-persona.yml: provenance publish workflow for the @agentworkforce/persona-* packs (all by default, or one via the package input); personas-core's publish-personas.yml is untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
7af79d5 to
18c9ab5
Compare
|
Reviewed PR #184 and fixed one release workflow issue. Change made:
Local validation run:
No bot-review files were present under |
|
✅ pr-reviewer applied fixes — committed and pushed Reviewed PR #184 and made one fix in .github/workflows/publish-persona.yml:
Validation run locally:
All passed. Note: |
Moves the autonomous-actor and nango-integrations personas into workforce as per-persona npm packs (mirroring the relayfile-adapters layout), and adds the private autonomous-run skill collection.
Persona packs (
packages/persona-*)@agentworkforce/persona-autonomous-actor(new, v0.1.0) — claude harness, modelclaude-opus-4-6, skills reference the remote@agent-relay/*packages.@agentworkforce/persona-nango-integrations(v0.1.6) — moved verbatim from relayfile-adapters; name and version unchanged so existing consumers keep working.Each pack ships only
personas/+index.js/index.d.ts/README(no skill sources in the tarball). Both packages' tests pass (8/8 each).Loader copy
.agentworkforce/workforce/personas/autonomous-actor.json— overridden with the remote-skill version (for workforce's own loader).Private skill collection
prpm.json(repo root,workforce-skills) — publishes the six autonomous-run skills with the privateautonomous-run-privatecollection inline (private: true,Proprietary). The manifest name is repo-level so it can hold more than the autonomous-run skills later..agentworkforce/workforce/skills/autonomous-run-contract/SKILL.md— adds the NEVER STOP + cross-repo standing constraints.Publishing
.github/workflows/publish-persona.yml— provenance (trusted-publishing) workflow named like relayfile-adapters'. Publishes all@agentworkforce/persona-*packs by default, or a single one via thepackageinput.personas-core'spublish-personas.ymlis untouched.Notes
nango-integrations.jsonis the verbatim relayfile-adapters persona; itsagentsMdContentprose still references the old local skill path (cosmetic — the skillsourceis the remote@agent-relay/trigger-autocomplete-catalog). Left as-is to keep nango unchanged; happy to apply the small prose fix if wanted.Companion: AgentWorkforce/relayfile-adapters#152 (removes the nango pack there).
🤖 Generated with Claude Code