feat: add @droid fix command for PR code fixes#63
Conversation
Add a new 'fix' command that triggers Droid to commit actual code changes when users @tag droid in PR comments. Includes: - Command parser detection for '@droid fix' - Fix prompt template with comment hierarchy logic: - Top-level PR comment (issue_comment): fix all review findings in scope - Review thread reply (pull_request_review_comment): fix specific issue - Fix command handler with PR branch checkout, file-editing tools, and git commit/push capability - fix_model action input for model override - Full test coverage for parser, command handler, and prompt generation Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
|
Droid finished @factory-nizar's task —— View job |
|
Droid finished @factory-nizar's task —— View job ✅ Review complete for PR #63 2 issues found (2 approved, 1 rejected):
|
Tests end-to-end through prepareTagExecution: - Top-level fix on PR comment (fix all review findings) - Thread reply fix on review comment (fix specific issue) - Routing: @droid without fix routes to review, not fix Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
![factory-droid[bot]](https://avatars.githubusercontent.com/in/358017?s=60&v=4){kind=small}
| } | ||
|
|
||
| // Check for @droid fix command (case insensitive) | ||
| const fixMatch = text.match(/@droid\s+fix/i); |
There was a problem hiding this comment.
[P1] Tighten @droid fix matching to avoid false positives
The regex /@droid\s+fix/i will also match prefixes like "@droid fixed" or "@droid fixes", unintentionally triggering fix mode from ordinary PR discussion. The security matcher in this same file already uses (?:\s|$|[^-\w]) to enforce a word boundary — apply the same pattern here to prevent false triggers.
| const fixMatch = text.match(/@droid\s+fix/i); | |
| const fixMatch = text.match(/@droid\s+fix(?:\s|$|[^-\w])/i); |
There was a problem hiding this comment.
The @droid fix feature is well-structured with good test coverage. One concrete issue: the fix command regex lacks a word boundary (unlike the existing security matcher in the same file), causing false positives on common words like "fixed" and "fixes". The remaining review suggestions are either speculative, design preferences, or consistent with existing codebase patterns.
| The following review comment identified an issue in \`${filePath}\`${lineContext}: | ||
|
|
||
| \`\`\` | ||
| ${parentBody} |
There was a problem hiding this comment.
[P1] Untrusted comment content is embedded verbatim into the fix prompt
parentCommentBody and user-supplied instructions are interpolated directly into the LLM prompt (including inside a fenced block), so a malicious review comment can break the fence (```), inject higher-priority instructions, or otherwise steer the agent into unsafe actions in a code-pushing flow; consider escaping fence sequences, clearly labeling these sections as untrusted data the model must not follow as instructions, and avoid embedding unescaped values in example shell commands.
| } | ||
|
|
||
| // Check for @droid fix command (case insensitive) | ||
| const fixMatch = text.match(/@droid\s+fix/i); |
There was a problem hiding this comment.
[P1] @droid fix detection can match fixes/fixed/fixing
The current regex /@droid\s+fix/i will also match @droid fixes or @droid fixed, which can unintentionally route to fix mode and start a code-modifying run; tighten this to require a word boundary/end (e.g. /@droid\s+fix\b/i or /@droid\s+fix(?:\s|$)/i) and add a regression test for @droid fixes.
There was a problem hiding this comment.
Good feature addition with solid test coverage. Two actionable issues found: the @droid fix regex can false-positive on natural language like @droid fixes/@droid fixed (triggering a code-pushing flow unintentionally), and untrusted review comment content is embedded verbatim into the fix prompt without fence-break protection in a flow that has git push capability.
1 participant
Summary
Add a new
@droid fixcommand that triggers Droid to commit actual code changes when users @tag droid in PR comments.Features
@droid fixparsed alongside existing fill/review/security commandsissue_comment): fix all review findings in scopepull_request_review_comment): fix the specific issue from that thread (uses file path, line number, parent comment body)fix_modelaction input: optional model override (likefill_model/review_model)Files added
src/tag/commands/fix.ts-- command handlersrc/create-prompt/templates/fix-prompt.ts-- prompt template with hierarchy logictest/modes/tag/fix-command.test.ts-- 6 handler teststest/create-prompt/templates/fix-prompt.test.ts-- 6 prompt testsFiles modified
src/github/utils/command-parser.ts-- addedfixtoDroidCommand+ regexsrc/tag/index.ts-- routed fix commandsrc/create-prompt/index.ts+types.ts-- addedFixContextpassthroughaction.yml-- addedfix_modelinputRelated