Conversation
|
Warning Review limit reachedNext included review available in 39 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to The requested workflow permissions are enabled without an identified functional or security regression. The change is ready to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
… connector
Two prompts per session for `unsubscribe_pr_activity` is the acute symptom,
and it is absurd on its face: `permissions.deny` already blocks SUBSCRIBING,
so unsubscribing is the call that restores the declared posture. It asked
for approval anyway, twice, because it was in neither list.
WHAT IS DELIBERATELY NOT HERE, and it is the half worth reading. Two
attempts at this added Linear grants and `connector grant loose` refused
the tree for both. The first added the reads (`get_issue`, `list_issues`,
`list_comments`); the second kept the WRITES (`save_issue`, `save_comment`)
on the theory that a `record = "board-writes"` row is captured rather than
reduced. Both were wrong, and the module says why in one line:
reduced_connector := "mcp__Linear"
The predicate is a PREFIX over the whole server, not a per-tool list — "a
grant naming one tool and a grant globbing the whole server are the same
finding, because either one puts the unreduced payload back on the model's
surface". So no `mcp__Linear*` entry belongs here at all, and the route
stays `batten mcp call`.
The measurement behind it: the raw tools WERE registered once, so that
session called them 973 times for 13.2 MB and 73% of all its tool output,
against 1.9 MB for Bash, Grep and Read together.
What goes in is what has no reduction to defeat: the two unsubscribe verbs,
the forge verbs this loop actually calls, `get_session`, and
`./target/debug/batten`, which `Bash(batten:*)` does not match because it
is path-qualified.
`timeout` is 473 calls and stays out: it wraps an arbitrary command, so
allowlisting it is a general execution grant wearing a prefix.
The `hooks` block is untouched.
Refs: CLOUD-1780
00305c9 to
73d098e
Compare
1 participant
Closes CLOUD-1780.
Two approval prompts per session for
unsubscribe_pr_activity, which is absurd on its face:permissions.denyalready blocks subscribing, so unsubscribing is the call that restores the declared posture. It prompted anyway because it was in neither list.The board writes are the same error one layer up. AGENTS.md makes moving the row part of doing the work — "the state transition IS how others know" — so gating
save_issueandsave_commentbehind a prompt gates the work, not a side effect. 45 calls this session, every one interactive.What is deliberately not here
An earlier attempt added
mcp__Linear__get_issue,list_issuesandlist_comments, andconnector grant looserefused the tree for it. The gate is right and the reasoning is worth keeping: both have[[mint]]reductions, so granting the raw tool puts a cheaper-looking route to the same payload in the model's own tool list. Measured 2026-08-31 — the raw tools were registered, so that session called them 973 times for 13.2 MB and 73% of all its tool output, against 1.9 MB for Bash, Grep and Read together.They were inert as well as harmful:
issue read loosedenies those tools at the mediated boundary whateverpermissions.allowsays. So the reads stay out and the route staysbatten mcp call.What goes in has no reduction to defeat: the two unsubscribe verbs, the recorded board writes (
record = "board-writes"— captured, not reduced), the forge verbs this loop calls, and./target/debug/batten, whichBash(batten:*)does not match because it is path-qualified.timeoutis 473 calls and stays out — it wraps an arbitrary command, so allowlisting it is a general execution grant wearing a prefix.hooksuntouched;hooks-wiring-checkreports 5 harnesses, 0 unwired.Branch name
The branch says
1819; the row is CLOUD-1780. CLOUD-1819 is the adjacentturn mint aheadtool-scope defect, still open.🤖 Generated with Claude Code
https://claude.ai/code/session_016LP3X4mHLU6kwirAAsFT8w
Generated by Claude Code