Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

⚡ Claude Token Optimization2026-05-26 — Security Guard

Aperta
  • Qualcosa non va?
#3,841 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
58/100
Tipo di issue
Refactoring
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
github-actions, typescript
Ambito
ci-cd, devops, performance

Direzione di ricerca

Start with .github/workflows/security-guard.md and review its current max-turns setting, task body, and embedded AGENTS.md context. Run gh aw compile .github/workflows/security-guard.md, then the listed post-processing and CI checks; done means the workflow passes and the next five Security Guard runs can be compared with the $0.30 baseline.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

claude-token-optimization

Target Workflow: Security Guard

Source report: #3839
Estimated cost per run: $0.30
Total tokens per run: ~363K (effective: ~3.4M with cache multiplier)
Cache read rate: 86.3% (6.8× more reads than writes — healthy)
Cache write rate (per run): ~67K tokens → $0.25/run in write cost
LLM turns: avg 6.0/run (max-turn failures hit 11)
Model: claude-opus-4-7 (declared: claude-sonnet-4-5)

Current Configuration

Setting Value
Tools loaded github: with toolsets: [pull_requests, repos] + bash via AWF
Tools actually used bash (safeoutputs CLI, gh pr diff, gh api)
Network groups github
Pre-agent steps ✅ Yes — diff pre-fetched into prompt
Prompt size ~8,500 chars (system prompt + AGENTS.md context ~17K chars)
max-turns 10

Key observation: The prompt explicitly instructs the agent not to call gh pr diff, but 10/23 runs (43%) call it anyway via bash. Every failed run exhausts all 11 turns (max-turns: 10 + 1 termination turn) before the agent gives up — burning $0.42–$0.57 in wasted compute.

Recommendations

1. Reduce max-turns from 10 to 5 ⚡ Highest Impact

Estimated savings: ~$2.50/period (~36% cost reduction on affected runs)

All 8 failed runs exhaust exactly 11 turns (the max-turns limit), costing $0.42–$0.57 each. These are timeout failures — the agent never converges. Capping at 5 turns halves the waste per failed run and forces the agent to make a decision with the data in-prompt rather than making sequential API calls.

The task is inherently simple: read a pre-fetched diff → decide security risk → noop or comment. A 2-turn run (Turn 1: analyze + call safeoutputs, Turn 2: implicit done) is ideal. Even a complex PR should resolve in 4 turns.

# In .github/workflows/security-guard.md
engine:
  id: claude
  model: claude-sonnet-4-5
  max-turns: 5   # was 10
2. Block Redundant gh pr diff Calls via Prompt Hardening

Estimated savings: ~$0.80/period (~12% reduction)

10/23 runs call gh pr diff via bash despite having the diff pre-fetched. Each redundant call adds 1–2 turns (fetch → parse → analyze), contributing to max-turn exhaustion on failed runs. The current instruction (Do NOT call gh pr diff) is being ignored.

Reinforce the constraint by prepending a hard guard at the top of the task body (currently buried after ~3KB of context). Agents follow instructions better when they appear first:

> ⛔ **HARD CONSTRAINT**: The diff below is complete. `gh pr diff`, `gh api .../files`,
> and `git diff` are FORBIDDEN. Calling them wastes turns and will cause this run to fail.
> If the diff section is empty, the PR has no changes — call `safeoutputs noop` immediately.

Also add a quick decision tree at the top of ## Your Task:

**Quick decision tree (follow this before doing anything else):**
1. Is the diff empty or null? → `safeoutputs noop` immediately (1 turn total)
2. Does the diff only add tests, docs, or comments with no security-boundary changes? → `safeoutputs noop` (1 turn)
3. Does the diff weaken security controls? → comment + label (2–3 turns max)
3. Trim AGENTS.md Context from System Prompt

Estimated savings: ~$0.22/period on cache-write cost + improved focus

The prompt includes the full AGENTS.md custom instruction (~17K characters). This drives the large per-request cache write (~67K tokens/run at $3.75/M = $0.25/run just in cache writes). The Security Guard only needs the security-focused sections — not the Docker architecture, DNS config, ARC/DinD docs, log analysis, or release docs.

Consider a trimmed <custom_instruction> block including only:

  • Critical Security Components section
  • Container iptables/Squid architecture summary (2–3 paragraphs)
  • Remove: DNS config, API proxy sidecar details, release docs, log analysis

Estimated context reduction: ~10K chars → saves ~2,500 cache-write tokens/run × $3.75/M × 23 runs ≈ $0.22/period.

Cache Analysis (Anthropic-Specific)

Sample from top 3 max-turn runs (11 turns each):

Metric Run 3338 Run 3332 Run 3331 Per Request (avg)
Input tokens 5,179 5,179 5,179 470
Output tokens 2,725 2,338 1,920 ~210
Cache read 636,360 502,701 589,511 ~50,000
Cache write 87,006 58,972 86,739 ~7,300
Requests 11 11 11 —
Cost $0.574 $0.423 $0.547 —

Cache write amortization: Turn 1 writes the full context (~50K tokens). Turns 2–11 each add ~3–5K in new cache-write tokens (tool results, agent output). Cache reads are healthy at ~50K/turn, meaning the large Turn 1 write is reused well within each session.

Cache cost vs benefit: Cache writes cost $3.75/M, reads save $2.70/M vs uncached input. Break-even is ~1.4 reads per write. With a 9:1 read/write ratio per run, caching is profitable. Do not disable caching.

Cross-run cache reuse: With a 5-minute TTL, cache is NOT reused across runs (PRs trigger independently). Each run starts fresh — the 86.3% cache read rate reflects within-run reuse across turns only.

Expected Impact

Metric Current Projected Savings
Total tokens/run ~363K ~180K -50%
Cost/run $0.30 $0.16 -47%
LLM turns (avg) 6.0 3.0 -3 turns
Failed run cost $0.49 $0.25 -49%
Period cost (23 runs) $6.89 ~$3.68 -47%

Implementation Checklist

  • Reduce max-turns: 10 → max-turns: 5 in .github/workflows/security-guard.md
  • Move the "Do NOT call gh pr diff" constraint to the top of the task body (before "## Repository Context")
  • Add hard-constraint block immediately above the pre-fetched diff section
  • Add the quick decision tree to the top of the "## Your Task" section
  • Trim AGENTS.md context to security-relevant sections only
  • Recompile: gh aw compile .github/workflows/security-guard.md
  • Post-process: npx tsx scripts/ci/postprocess-smoke-workflows.ts (if applicable)
  • Verify CI passes on PR
  • Compare token usage on next 5 Security Guard runs vs $0.30 baseline

Generated by Daily Claude Token Optimization Advisor · sonnet46 1.3M · ◷

Lingua principale
TypeScript
Stelle
145
Fork
63
Merge medio
6h 15m
PR unite (30g)
248

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/gh-aw-firewall

Tutte le issue di github/gh-aw-firewall

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.