Open Pull Request Audit — July 2026

Purpose

This audit reviews all 18 pull requests open on 2026-07-14. It explains what each PR contributes, whether it fits OpenAgents Control, and what should happen next. No PR was merged, closed, approved, or modified during the audit.

Decision Summary

PR	Purpose	Recommendation	Main reason
#195	“Auto-migration to Cloud” bundle	Close	Unrelated Django, CI, eval, and package changes; failed checks; no coherent OAC feature
#295	Worktree management skill	Needs redesign	Forced worktree deletion, Docker volume deletion, hidden package-script execution, unstable ports
#296	Claude plugin registration and ability executor	Needs redesign	Invalid manifest shape, shell injection risk, permission bypasses, fake approvals, incomplete execution
#297	Installer and registry corrections	Needs redesign	Root-level files can escape the selected install directory; conflicts; metadata fix already merged elsewhere
#298	npm/Bun OAC package manager	Needs redesign	Valuable direction, but duplicates merged work and can overwrite or recursively delete user-owned files
#300	TDD enforcement and model router	Needs redesign	Unsafe registry-driven writes, impossible permission flow, language-specific policy presented as universal
#301	Task router worktree detection	Merge after minor revisions	Correct `.git` file support, but fallback wrongly accepts arbitrary directories as project roots
#302	Allow OpenCode `question` tool	Merge	Valid two-line permission change that improves clarification without granting execution authority
#305	Task CLI Node/ESM imports	Merge after minor revisions	Correct narrow fix; runtime and CI typecheck/smoke-test requirements are still undeclared
#309	Skip `node_modules` in updater	Merge after minor revisions	Focused valid fix; add a durable updater regression test
#311	Eval fallback model change	Needs redesign	Replacement model is stale and the underlying unavailable-model false-success behavior remains
#312	Auto-install Windows dependencies	Needs redesign	Read-only commands may silently install host software without approval
#314	Nix flake and Home Manager support	Needs redesign	Supply-chain and approval problems; duplicates installer/resolver logic; high maintenance burden
#316	OpenCode tool-barrel workaround	Needs redesign	Useful one-file fix bundled with unsafe approval-evaluator and unrelated behavior changes
#324	MiniMax M3 support	Merge after minor revisions	Strong product fit; vendor capability claims and behavior values need correction and real test evidence
#325	Register missing TypeScript/C# contexts	Merge after minor revisions	Correct registry repair; changed Bash validator needs focused tests
#326	Preserve local context paths	Needs redesign	Fixes one path case by broadly breaking globally installed context dependencies
#328	Legacy updater rewrite	Needs redesign	Treats network failures as local-only files and removes safe recovery from failed overwrites

Immediate Repository Blockers

1. Privileged PR workflow

.github/workflows/validate-registry.yml uses pull_request_target, grants repository write permissions, checks out contributor-controlled code, installs its dependencies, and executes its scripts. A malicious fork could execute code in a privileged workflow context.

Required direction:

Run contributor code under pull_request with read-only permissions and no secrets.
Keep any pull_request_target job metadata-only; never check out or execute the contributor head there.
Move registry updates to a separate maintainer-approved workflow.
Pin third-party actions to reviewed commit SHAs where practical.

2. PR checks do not trigger correctly

.github/workflows/pr-checks.yml declares outputs from steps.filter.outputs.evals, but the script writes has-evals. As a result, relevant TypeScript build validation can be skipped. The workflow also does not run Vitest.

Required direction:

Make output names consistent.
Run compilation, unit tests, and targeted validation based on changed areas.
Ensure summary jobs fail when any required matrix job fails.

3. Green CI is not sufficient evidence

Most open PRs only passed registry validation. Shell installers, updater behavior, worktree cleanup, plugin loading, task CLI execution, eval behavior, Nix modules, and model tests were usually not exercised.

Safe Processing Order

Fix PR workflow security and CI change detection.
Merge #302 after a final diff check.
Revise, validate, and process #309 and #325.
Revise and validate #305, then #301.
Correct model facts and run real tests for #324.
Close #195 after preserving any useful isolated ideas as issues.
Ask authors of redesign PRs to split or replace them with focused PRs based on current main.
Do not merge #295, #296, #297, #298, #300, #311, #312, #314, #316, #326, or #328 as submitted.

Required Splits and Replacements

#316

Create a clean PR containing only the .opencode/tool/index.ts workaround. Review approval-evaluator changes separately.

#297

Recreate useful custom-selection fixes on current main. Exclude the unsafe root destination behavior and agent metadata already handled by merged #280.

#296

Split into:

A narrow Claude Code plugin discovery/manifest correction.
A later permission-aware ability executor with structured arguments, real approval responses, worktree containment, and cancellation.

#300