Automated triage of 14 open PRs (all new since last run 2026-03-25).
🔴 Action Required: Shell-Injection Cluster Conflict
PRs #4228, #4236, and #4245 all address the same heredoc/shell-injection problem but use different approaches:
| PR |
Approach |
Tests |
| #4228 |
Quoted heredocs (<<'EOF') across default + consensus workflows |
171 |
| #4236 |
Quoted heredocs + PR URL resolution |
— |
| #4245 |
Direct env-var assignment (most robust, avoids terminator collision) |
yes |
Recommendation: Adopt #4245 (env-var assignment), which eliminates the terminator-collision failure mode entirely. Close #4228 and #4236 as superseded.
✅ Merge-Ready (CI green + quality audits complete)
| PR |
Title |
Risk |
| #4207 |
fix: SEARCH_TITLE quoting + unsafe conditions in default-workflow |
Low |
| #4203 |
fix(#4169): smart-orchestrator teardown hardening + atlas refresh |
Medium |
Both report CI green and 3 clean quality-audit cycles.
🔒 Security Review Needed
| PR |
Title |
Priority |
| #4245 |
fix(recipes): replace quoted heredocs with direct env-var assignment |
High |
| #4236 |
fix(recipes): step-03 shell quoting + PR URL resolution |
High |
| #4228 |
fix: repair shell quoting in step-03 issue creation |
High |
Once approach is chosen (see cluster conflict above), security review the winner before merging.
📋 Ready for Review
| PR |
Title |
Risk |
Notes |
| #4216 |
feat: safe Anthropic disablement via ANTHROPIC_DISABLED flag |
Medium |
41 tests; closes #4215 |
| #4190 |
fix(cli): preserve entrypoint and patch surfaces |
Medium |
sys.exit + lazy AutoMode; gadugi + pyright pass |
| #4199 |
fix(recipe-runner): auto-update rust runner on version mismatch |
Low |
Closes #4159 |
| #4198 |
fix(knowledge_builder): guard --dangerously-skip-permissions for copilot |
Low |
Closes #4188 |
| #4186 |
docs(multitask): add TIMEOUT_LIFECYCLE.md |
Low |
19 tests; closes #4183 |
📄 Documentation / Low Priority
| PR |
Title |
Notes |
| #4258 |
docs: daily documentation update 2026-04-06 (DRAFT) |
⚠️ Expires today — review promptly |
| #4112 |
docs: clarify required vs optional API keys (#3844) |
External contributor (xingzihai) |
| #3984 |
docs: clarify API keys in CONTRIBUTING.md |
External contributor — duplicate of #4112, close in favor of #4112 |
❌ Close Recommended
| PR |
Reason |
| #4234 |
Thin automated external contribution; superseded by #4236; minimal description |
| #3984 |
Duplicate of #4112 (same issue #3844, #4112 is newer and more complete) |
Summary
| Category |
Count |
| Security/high-priority fixes (cluster) |
3 |
| Merge-ready |
2 |
| Ready for review |
5 |
| Docs/low-priority |
3 |
| Close recommended |
2 |
| Total open |
14 |
Run ID: 24058489791
Generated by PR Triage Agent · ◷
Automated triage of 14 open PRs (all new since last run 2026-03-25).
🔴 Action Required: Shell-Injection Cluster Conflict
PRs #4228, #4236, and #4245 all address the same heredoc/shell-injection problem but use different approaches:
<<'EOF') across default + consensus workflowsRecommendation: Adopt #4245 (env-var assignment), which eliminates the terminator-collision failure mode entirely. Close #4228 and #4236 as superseded.
✅ Merge-Ready (CI green + quality audits complete)
Both report CI green and 3 clean quality-audit cycles.
🔒 Security Review Needed
Once approach is chosen (see cluster conflict above), security review the winner before merging.
📋 Ready for Review
📄 Documentation / Low Priority
❌ Close Recommended
Summary
Run ID: 24058489791