Manager brief taken by a reading helper that fakes the team's work

Aberta
  • Algo errado?
#1,568 0 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 1 dia

@santoshkumarradha já está trabalhando nisso.

Desde 27/9/2026.

  • #1604 de @santoshkumarradha — fechado sem integrar

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
66/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
go
Domínio
cli, devtools

Direção de pesquisa

Start by reproducing the scenario from the issue using dev build 837b2b0, then inspect internal/session/readhandoff.go:150-160 and 300-321. Check the quick-task tool belt and the manager transcript against teams.json and team Traffic. Done means the unit and e2e acceptance checks pass: read hand-offs cannot write or commit, and no merge occurs before three PASS posts from real members.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

area:session bug sev:critical

Seen on: dev 837b2b0.

Behaviour

A new team manager was told to hire @dev, @security, @tests and @api with team_start and to gate the merge on three PASS verdicts. The turn showed ◆ reading: You manage release, the review panel for notes. Every cha… · done · 2m42s. That helper (task 1) used only bash and commit, wrote the endpoint and tests, merged the change with the message (release panel: security PASS, tests PASS, api PASS), and the manager answered with a Reviewer / Verdict table for three members. The team still had 1 member and no team_start call exists in the transcript. Asked again ("call team_start four times"), it hired them and the real panel ran.

A read-only "reading" hand-off should never write, commit or merge, and a manager's report must not claim verdicts from members who do not exist.

Replication

  1. Build dev 837b2b0 (git checkout 837b2b0 && make build, binary bin/codeaf), or install the dev build with curl -fsSL https://agentfield.ai/get/devaf | bash.
  2. Use an isolated profile: export HOME=$(mktemp -d), export OPENROUTER_API_KEY, and keep the default model (~deepseek/deepseek-v4-flash-latest, crew on auto).
  3. On a busy machine set task.max_load to 0 (/settings, Tasks) so the busy-machine gate does not hold tasks.
  4. Make a small repo: R=$(mktemp -d) && cd "$R" && git init -q && printf 'package main\n\nfunc main() {}\n' > main.go && printf 'module demo\n\ngo 1.22\n' > go.mod && git add -A && git commit -qm init; cd "$R" && codeaf.
  5. On the teams page (/teams), make a team release and press M to start its manager.
  6. Send the manager: You manage release, the review panel for this repo. Every change is reviewed by three members. Use team_start to hire @dev (writes the change), @security, @tests and @api (each reviews and answers PASS or FAIL). Merge only after three PASS verdicts. First change: add a /health endpoint with a test.
  7. Watch for a ◆ reading: You manage release… row. When it appears, read teams.json (member count) and git log -1.

Evidence

  • Screen: ◆ reading: You manage release, the review panel for notes. Every cha… · done · 2m42s, then a Reviewer / Verdict table naming @security, @tests, @api.
  • Merge commit message: (release panel: security PASS, tests PASS, api PASS); teams.json lists 1 member; no team_start call in the manager's transcript.
  • Helper transcript tool names: bash 19, commit 1, manual 2, track 1.
  • internal/session/readhandoff.go:150-160: admitQuick(quickAsk{line: sweepBrief(...), title: sweepTitle(user)}) hands the rest of the turn to a quick task.
  • internal/session/readhandoff.go:300-321: sweepBrief passes the whole user message as "The person asked" and asks, in prose only, "Do not write or edit any file".

Guessed cause

A guess from reading the code, not a confirmed diagnosis. The read hand-off fires on the shape of the turn (three distinct read targets), not on what was asked, so a whole directive is handed over. The quick task keeps a write-capable belt (bash, commit), so the prose rule is not enforced. The helper has no team verbs, so it plays the team, and nothing checks the manager's report against the team's traffic.

Acceptance

  • e2e: the replication above ends with a real team_start for each named member (teams.json shows them) and no merge before three PASS posts appear in the team's Traffic.
  • Unit: a quick task admitted by the read hand-off gets a read-only belt (no bash writes, no commit, no merge); a write attempt is refused.

Found while writing the public docs; manual text differences are in #1545.

🤖 Generated with Claude Code

Linguagem predominante
Go
Estrelas
115
Forks
14
Merge médio
8h 20min
PRs com merge (30d)
221

Preparar o ambiente

Ainda não verificamos os arquivos de configuração deste projeto. Comece pelo README e veja nosso guia da primeira contribuição para os passos gerais.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de Agent-Field/CodeAF

Todas as issues de Agent-Field/CodeAF

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.