Make the Anthropic provider code-aware via PR diff injection#4
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_47421aea-d721-4153-bcd8-818a89b08aa9) |
Production polish: installable, multi-provider, observable
chore: reduce npm audit vulnerabilities
- AGENTS.md (new): guardrails for humans + coding agents — npmjs registry, and do not remove/loosen the overrides or regenerate the lockfile elsewhere - docs/dependencies.md (new): per-override rationale + consumer chains + remove-when, the Node 26 clean-install verification, and why undici 5->6 is runtime-inert on Node >=18 - .npmrc (new): pin registry to npmjs.org (npmmirror's advisory endpoint is NOT_IMPLEMENTED, which breaks npm audit and caused the mixed-registry lockfile) - CLAUDE.md: symlink to AGENTS.md so Claude Code loads the same notes Documents the overrides added in #2; removal tracked in #5.
- Regenerate package-lock.json against npmjs (.npmrc); no more mixed npmmirror/npmjs resolved URLs (was 133/9, now 0/142). - package.json: add overridesNote pointing at docs/dependencies.md (#5). Verified: overrides intact (tar@7.5.16, undici@6.26.0, @tootallnate/once@2.0.1), npm audit -> 0, tests green.
docs: document npm overrides + standardize npm registry
Folds the generally-useful run notes from the Cursor Cloud setup PR (#3) into the existing AGENTS.md: the offline plan-pr / --plan-only flow, --scored for local input, live-command credentials, and the ~/.cursor canvas-mirror flag. Corrects #3's now-stale gotcha — plan-pr is plan-only by design on main (cli.ts dispatches planOnly: true) — and notes prebuild auto-cleans dist. Drops #3's package-lock change, since main standardized on the npmjs registry in #6.
docs(AGENTS): build/test/run notes (salvaged from #3)
Replaces the blind Messages-API adapter: --provider anthropic now fetches the PR's unified diff (REST diff media type, or `gh pr diff` fallback) and injects it into each task prompt, so the model reasons about the actual changed code instead of only the finding text. - github.ts: fetchPrDiff(repo, pr) - types.ts / runner.ts: thread repo + pr into TaskExecutionInput - adapters/anthropic.ts: per-run memoized diff fetch shared across tasks; testable buildDiffPrompt with a size cap and graceful degrade when the diff cannot be fetched; max_tokens 4096 -> 8192 - test/anthropic.test.ts: buildDiffPrompt coverage Addresses the High-severity bot finding that --provider anthropic had no repository access. Cursor remains the default provider.
Wenjix
force-pushed
the
anthropic-diff-injection
branch
from
f186360 to
5a56434
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
- github.ts: fetchPrDiff falls back to `gh pr diff` when the REST request fails (token expiry/scope/rate limit), not only when no token is set. - anthropic.ts: key the diff cache by repo#pr (no cross-PR contamination) and wrap the fetch in withRetry so a transient blip doesn't blind the whole run.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e5b57f7. Configure here.
| "Do not suggest edits, create commits, push branches, or open pull requests.", | ||
| "Return a concise human-readable explanation, then end with exactly one fenced JSON block as specified.", | ||
| ].join("\n"); | ||
| const diff = await this.loadDiff(input.repo, input.pr); |
There was a problem hiding this comment.
Diff fetch ignores task abort
Medium Severity
runOnce awaits loadDiff before the Anthropic request, but loadDiff’s withRetry never receives input.signal, and fetchPrDiff / gh aren’t cancellable. After the runner’s withTimeout aborts, PR diff work (including retry backoff) can keep running even though the task is already marked timed out.
Reviewed by Cursor Bugbot for commit e5b57f7. Configure here.
| "", | ||
| "<pr_diff>", | ||
| body, | ||
| "</pr_diff>", |
There was a problem hiding this comment.
Diff can break delimiter tags
Low Severity
buildDiffPrompt wraps the unified diff in literal <pr_diff> / </pr_diff> markers without escaping. If the PR adds or changes a line containing </pr_diff>, that substring appears inside the injected body and can split what the model treats as diff versus task instructions.
Reviewed by Cursor Bugbot for commit e5b57f7. Configure here.
2 participants
What
--provider anthropicwas effectively blind: the adapter sent only the stitched text prompt to the Messages API — no repo, no diff — so explorations couldn't inspect the PR's code (flagged High by Cursor Bugbot + Devin on PR #1). This makes the Anthropic path code-aware by fetching the PR's unified diff locally and injecting it into each task prompt.How
fetchPrDiff(repo, pr)ingithub.ts— REST diff media type when a token is set,gh pr difffallback (reuses existing auth plumbing).buildDiffPrompt.repo/prthreaded intoTaskExecutionInput.Notes
--provider anthropicnow needs GitHub read access (the same token/ghalready used for comments) to fetch the diff.production-polish(PR Production polish: installable, multi-provider, observable #1) — it builds on that branch's retry/provider scaffolding. Retarget tomainafter Production polish: installable, multi-provider, observable #1 merges.pattern-sweep, model-gated adaptive thinking, aquorum setupprerequisite check. Cursor remains the default provider.Test
npm test— 34 pass (+3buildDiffPrompt).🤖 Generated with Claude Code
Note
Medium Risk
Anthropic runs now send full PR diff text to a third-party API and depend on GitHub read access; npm overrides change install-time transitive versions (documented as low runtime impact on Node ≥22).
Overview
Makes
--provider anthropiccode-aware by fetching the PR unified diff and injecting it into each Messages API call, instead of sending only the stitched task text.Anthropic path: New
fetchPrDiffingithub.ts(REST diff media type when a token exists,gh pr difffallback). The runner passesrepo/pronTaskExecutionInput.AnthropicAdaptermemoizes one diff per PR, retries fetch failures, then builds the user turn viabuildDiffPrompt(200k char cap, explicit note when diff is missing). System prompt andmax_tokens(8192) are updated for diff-based analysis; the browser-only API header is removed. Tests coverbuildDiffPrompt.Dependencies & contributor docs:
.npmrcpinsregistry.npmjs.orgsonpm auditworks.package.jsonadds intentionaloverridesfortar,undici, and@tootallnate/once(transitive@cursor/sdkaudit fixes).package-lock.jsonis re-resolved from npmjs with those pinned versions.AGENTS.md/docs/dependencies.mddocument registry rules, overrides, and build/run expectations;CLAUDE.mdpoints atAGENTS.md.Reviewed by Cursor Bugbot for commit e5b57f7. Bugbot is set up for automated code reviews on this repo. Configure here.