Connect installer to Stories 2/7 content (and move enrollment to a repo maintenance workflow in the .fullsend repo)

[ralphbean]

Summary

• Bidirectional enrollment reconciliation: when a repo is set to enabled: false in config.yaml, the repo-maintenance.yml workflow now creates a PR to remove the shim workflow from that repo (via GitHub Contents API DELETE with blob SHA). Stale cross-direction PRs are automatically closed.
• Single shim source of truth: collapsed internal/scaffold/target-repo/ into internal/scaffold/fullsend-repo/templates/shim-workflow.yaml — one copy, no sync test needed.
• Scaffold package: embedded .fullsend repo content with WalkFullsendRepo for filesystem-order deployment.
• Forge client extensions: DispatchWorkflow, ListWorkflowRuns, AwaitWorkflowRun, DeleteFile, ListPullRequests methods added.
• Security hardening: control-character rejection in repo name validation, sanitized error messages (no raw user input in ::error:: annotations), yq query fix (enabled != true to match Go zero-value semantics).
• Normative spec updates: ADR-0012 (fullsend-repo files) and ADR-0013 (enrollment) updated for reconciliation workflow, unenrollment constants, and single-copy shim template.
• E2E test improvements: triage dispatch smoke test, PAT handling, and XSS prevention in appsetup.

Test plan

• make go-test — all unit tests pass
• make go-vet — clean
• Enrollment layer tests cover: dispatch, PR reporting, no-repos, dispatch error, workflow warning, uninstall noop
• Analyze tests cover: all enrolled, none enrolled, partial, no repos, disabled with stale shim, disabled already clean, mixed enabled/disabled
• Scaffold tests verify single shim template content and all expected files exist
• Config tests verify DisabledRepos() returns sorted disabled repos
• Install it manually to an org, like this:

$ make go-build
$ ./bin/fullsend admin install your-org
        \ --repo your-repo-in-that-org
        \ --gcp-region global
        \ --gcp-project your-gcp-project-name
        \ --gcp-credentials-file path/to/gcp/service/account/credentials.json

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://aa200451-site.fullsend-ai.workers.dev

Commit: 7e2c41076a8ef91cd9af491e91966514307c0185

[ralphbean]

I ran this against my appdumpster org and the test-repo repo there.

You can see:

• The .fullsend repo.
• The enrollment PR sent by the repo maintenance workflow in the .fullsend repo when that repo was set to enabled: true in config.yaml
• The test issue in the test-repo where I commented with /triage.
• The dispatch-triage job in the test-repo repo that ran as a result.
• The triage agent run in the .fullsend repo that ran, with inference, in the sandbox. Woot!

You'll notice also that the triage agent thinks its a duck.

I used this to test out a development workflow. In my local git repo, I can hack on internal/scaffold/fullsend-repo/agents/triage.md (or other scaffold files) and replace it with instructions that say, for instance, "You are a duck. Quack!". And then I can make go-build && ./bin/fullsend admin install ... on an org where fullsend is already installed, and the installer will update that org's .fullsend config files with new config files from your local, uncommitted, git directory. This lets you quickly experiment with how changes might affect agent behavior in the real system.

[waynesun09]

Security review: inputs.source_repo validation gap in per-role workflows (triage/code/review.yml). See inline comments for the detailed fix — a three-layer validation step (regex, owner check, config allowlist) should be inserted before the app token is generated.

[waynesun09]

Security Review — High & Medium Findings

High (blocking)

inputs.source_repo checkout without validation — all three per-role workflows (triage.yml, code.yml, review.yml) checkout inputs.source_repo directly using an app token. Since these are workflow_dispatch workflows, any caller with FULLSEND_DISPATCH_TOKEN can point checkout at an attacker-controlled repo. Fix: add a three-layer validation step (regex, owner check, config.yaml allowlist) before the app token is generated. See inline comment on triage.yml for the full suggested fix.

Medium (non-blocking)

1. workflows: write permission on fullsend app (types.go) — combined with contents: write, this allows creating/modifying workflow files in all installed repos. Document the permission escalation and consider scoping the token more narrowly.

2. fromJSON(inputs.event_payload) in workflow expressions (triage.yml, code.yml, review.yml) — concurrency keys and env vars parse attacker-controllable JSON from dispatch inputs. Risk is gated by the dispatch token but could enable concurrency group collision or agent prompt manipulation via crafted html_url.

[waynesun09]

Outdated GitHub Actions: actions/checkout (v4 → v6), actions/create-github-app-token (v2 → v3), actions/upload-artifact (v4 → v7). See inline comment for details.

[waynesun09]

Review — Ralph's fix commit (9879bc6) and overall PR

source_repo validation fix: Looks good

The three-layer validation (regex, org owner check, config.yaml allowlist) is well-designed and correctly placed before token generation. Examined bypass vectors — regex edge cases, TOCTOU, shell injection, yq injection — none exploitable. Error messages are properly sanitized (no raw input echoed). Action version bumps (checkout v6, create-github-app-token v3, upload-artifact v7) are current.

Ralph's decision to accept the fromJSON(inputs.event_payload) residual risk is reasonable — exploitation requires the dispatch token, and the validation now blocks the primary escalation path (arbitrary repo checkout).

ADR-0007 permission escalation note adequately covers the workflows: write risk with three mitigations.

Remaining items (see inline comments)

1. Plan doc inclusion — docs/superpowers/plans/2026-04-17-installer-scaffold-and-repo-maintenance.md (1,287 lines) is an agent implementation guide, not a deliverable. Contains outdated shim patterns with inline expression interpolation. Should be removed from this PR.
2. PAT credential leak — e2e/admin/pat.go:482 logs the full plaintext token (82 chars) into CI logs via a debug logf that captures 100 chars after github_pat_.
3. jq null handling — reconcile-repos.sh uses .[0].url which returns literal "null" with standalone jq on empty arrays. Currently safe with gh --jq (which suppresses nulls), but // empty is a defensive hardening.

[waynesun09]

Overall Review — Round 2

The prior findings (plan doc removal, PAT credential leak, jq null handling) are all resolved. Ralph's three-layer source_repo validation is solid. The scaffold and enrollment reconciliation architecture are well-designed.

New findings from this round

Should fix before merge:

1. set -e + gh api abort (reconcile-repos.sh:126) — if any repo is inaccessible, the entire reconciliation script aborts instead of skipping that repo. The -z guards are dead code under set -euo pipefail. Add || true to gh api calls at lines 126, 134, 238, 246.

2. enabled != true treats omission as disabled (reconcile-repos.sh:204) — repos added to config.yaml without an explicit enabled field get caught by the unenroll phase. If a repo happens to have a .github/workflows/fullsend.yaml for unrelated reasons, the script would open a PR to delete it. Use select(.value.enabled == false) to only unenroll explicitly disabled repos.

3. Triage dispatches on labeled events (shim-workflow.yaml:27-32) — dispatch-triage matches all issues events including labeled, causing redundant triage runs on every stage transition (triage→code, code→review). ADR-0002 defines triage triggers as opened, edited, and /triage only. Add action filtering.

Non-blocking nits:

4. io.ReadAll unbounded (github.go:993) — no size limit on workflow job log reads. Consider io.LimitReader.

5. Design spec retains unsafe shim pattern (2026-04-17-installer-agent-content-design.md) — still shows inline ${{ toJSON(github.event) }} instead of the env-var approach used in the actual scaffold. Lower risk than the removed plan doc but could mislead contributors.

[waynesun09]

All prior findings resolved. Latest commit (7e2c4107) correctly addresses the set -e trap (|| true on all gh api --jq calls) and enabled == false semantics.

One non-blocking item remains: dispatch-triage in the shim fires on labeled events, causing redundant triage runs on stage transitions (see inline comment on shim-workflow.yaml). Can be addressed in a follow-up.

LGTM.