Problem
#5084/#5087 widened `@gittensory chat` to authorize a PR's own author, gated on `commandRateLimitPolicy: hold`. That gate doesn't check PR state at all -- the rate limiter (`maybeThrottleGittensoryCommand`) is keyed by `repoFullName#issueNumber#command`, so a closed/merged PR keeps its own independent, never-reset counter forever, and a brand-new PR gets a fresh one regardless of what happened on prior PRs.
Concretely: a contributor could burn their per-PR chat allowance, then open a new PR (or reuse/reopen an old one) to get a fresh allowance, indefinitely. Draft PRs are especially cheap to open and are NOT excluded either, since GitHub's `state` field reports them as "open".
This was a low risk when chat was maintainer/collaborator-only (a small, trusted population). Now that any PR author qualifies, the exploitable population is anyone who can open a PR.
Proposal
Require the PR to be open AND not draft for a bare `pr_author` match on `chat` to authorize -- enforced in `evaluateCommandAuthorization` (in code, not just convention), the same way #5084 gated on `commandRateLimitPolicy`. Scoped ONLY to the `pr_author` tier; maintainers/collaborators are unaffected (the check exists to bound a less-trusted population, not to restrict already-trusted ones).
Note: this does not by itself bound "open N genuinely-open non-draft PRs and burn the allowance on each" -- that's a separate, already-existing lever (`contributorOpenPrCap`), not something this issue needs to duplicate.
Acceptance criteria
- A `pr_author` match on `chat` for a closed, merged, or draft PR is denied with a distinct, legible reason.
- Maintainers/collaborators are completely unaffected regardless of PR state.
- Full branch-coverage tests, including an end-to-end case for closed/draft/open PRs.
Problem
#5084/#5087 widened `@gittensory chat` to authorize a PR's own author, gated on `commandRateLimitPolicy: hold`. That gate doesn't check PR state at all -- the rate limiter (`maybeThrottleGittensoryCommand`) is keyed by `repoFullName#issueNumber#command`, so a closed/merged PR keeps its own independent, never-reset counter forever, and a brand-new PR gets a fresh one regardless of what happened on prior PRs.
Concretely: a contributor could burn their per-PR chat allowance, then open a new PR (or reuse/reopen an old one) to get a fresh allowance, indefinitely. Draft PRs are especially cheap to open and are NOT excluded either, since GitHub's `state` field reports them as "open".
This was a low risk when chat was maintainer/collaborator-only (a small, trusted population). Now that any PR author qualifies, the exploitable population is anyone who can open a PR.
Proposal
Require the PR to be open AND not draft for a bare `pr_author` match on `chat` to authorize -- enforced in `evaluateCommandAuthorization` (in code, not just convention), the same way #5084 gated on `commandRateLimitPolicy`. Scoped ONLY to the `pr_author` tier; maintainers/collaborators are unaffected (the check exists to bound a less-trusted population, not to restrict already-trusted ones).
Note: this does not by itself bound "open N genuinely-open non-draft PRs and burn the allowance on each" -- that's a separate, already-existing lever (`contributorOpenPrCap`), not something this issue needs to duplicate.
Acceptance criteria