fix(#1496): exclude coder bot PRs from pre-code check

[fullsend-ai-coder]

The pre-code.sh existing-PR check filtered out PRs authored by the main bot (fullsend-ai[bot]) but not the coder bot (fullsend-ai-coder[bot]). When the coder created a PR with "Closes #N", subsequent runs found that PR and blocked, treating the coder's own work as a duplicate.

Add CODER_BOT_LOGIN (defaulting to fullsend-ai-coder[bot]) and exclude it in the jq filter alongside BOT_LOGIN. Add two test cases covering coder-bot-only and mixed scenarios.

Note: pre-commit could not run (Go toolchain permission denied in sandbox). Tests passed via pre-code-test.sh.

---

Closes #1496

Post-script verification

• Branch is not main/master (agent/1496-exclude-coder-bot-prs)
• Secret scan passed (gitleaks — addf9a24b1a9d937a2e2027b8c67a84f8d087739..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://f6f7985e-site.fullsend-ai.workers.dev

Commit: 116d66c346879187adbd46bd23c3a4c865e33207

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] internal/scaffold/fullsend-repo/scripts/pre-code.sh, internal/scaffold/fullsend-repo/scripts/pre-code-test.sh — Both modified files are under scripts/, a protected path. The PR links to Coder agent thinks its own work is duplication #1496 and the description explains the rationale (coder bot's own PRs were treated as duplicates). Human approval is required for protected-path changes regardless of context.

Low

• [correctness] internal/scaffold/fullsend-repo/scripts/pre-code.sh:69 — The FULLSEND_BOT_LOGIN env var override was removed: BOT_LOGIN changed from ${FULLSEND_BOT_LOGIN:-fullsend-ai[bot]} to a hardcoded fullsend-ai[bot], and the new CODER_BOT_LOGIN is also hardcoded. Per docs/guides/user/customizing-agents.md, bot naming follows {org}-coder[bot] convention. If this scaffold is deployed to other orgs, both bot logins should be configurable via env vars (e.g., ${FULLSEND_CODER_BOT_LOGIN:-fullsend-ai-coder[bot]}). Remediation: Restore the env var pattern for BOT_LOGIN and add one for CODER_BOT_LOGIN.

Previous run

Review

Findings

Low

• [test-coverage] internal/scaffold/fullsend-repo/scripts/pre-code-test.sh — The two new test cases (coder-bot-pr-does-not-block and coder-bot-pr-plus-human-pr-blocks) document the intended behavior but don't exercise the new jq filter logic. The mock gh binary returns pre-configured output and ignores --jq, so coder-bot-pr-does-not-block (empty input) is functionally identical to the existing no-existing-prs-proceeds test, and coder-bot-pr-plus-human-pr-blocks (human PR output) is identical to human-pr-skips-agent. This is consistent with the existing test architecture — the tests validate script control flow given various gh pr list outputs, not the jq expression itself.
  Remediation: Consider adding an integration-style test that pipes actual jq expressions through jq with sample JSON containing both coder-bot and human PRs, verifying the filter produces the expected output. This would cover the new and .author.login != "..." clause directly.

Previous run (2)

Review

Findings

No findings.

[ralphbean]

/fs-review What supplies the value for FULLSEND_CODER_BOT_LOGIN? Will that end up being the correct fullsend-ai-coder[bot] login in the end even though it defaults to another value?

Double check that the logic is consistent between pre-code and post-code here.

[rh-hemartin]

/fs-fix

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Addressed review feedback: removed FULLSEND_BOT_LOGIN and FULLSEND_CODER_BOT_LOGIN env var indirection, hardcoding bot login names directly. All tests pass.

Fixed (1):

1. Remove FULLSEND_BOT_LOGIN and FULLSEND_CODER_BOT_LOGIN env var indirection (internal/scaffold/fullsend-repo/scripts/pre-code.sh): Removed env var indirection for BOT_LOGIN and CODER_BOT_LOGIN per reviewer feedback — hardcoded the bot login strings directly since these values don't need to be configurable.

Tests: passed

_{Updated by fullsend fix agent}

[ralphbean]

LGTM. Filed #1667 to track a test coverage gap (the mock gh bypasses --jq, so the bot-exclusion tests don't exercise the filter), but that's pre-existing and non-blocking.