fix: herdr target source, changelog-owner check; test: clean-room tolerant reader; chore: dependabot labels

[cameronsjo]

Summary

• Filtered tmux menu (tui: menuMode activate() uses raw index, not filter-aware SelectedItem() #496): now handled by fix: docs reader UX pass, review-window env leaks, tmux menu filter, govulncheck #531. fix: docs reader UX pass, review-window env leaks, tmux menu filter, govulncheck #531 merged first with the same fix. The conflict is resolved in favor of main (its typed act enum and its tests), so this PR no longer changes internal/tui/.
• A rejected herdr target names where it came from (Closes recipe afk passes an unvalidated herdr target as a leading argv element #464). The fix(recipe): submit /compact through agent prompt, not the unreleased type-submit #475 allowlist already rejects a malformed target, but the error named only the value. resolveRecipeHerdrTarget now also returns the source (--target, HERDR_PANE_ID or HERDR_ACTIVE_PANE_ID), and the error adds (from HERDR_PANE_ID) or whichever source applied.
• The changelog-owner check stops blaming PRs for main's releases (Closes check-changelog-owner fails on any PR that predates a release cut #458). In CI the checkout is GitHub's PR merge commit. When its second parent is HEAD_SHA (passed from pull_request.head.sha), the script diffs HEAD^1..HEAD, which is exactly the PR's effect on the current base. A release that landed on main after the branch point is no longer blamed on the PR, and no merge base is involved. In every other case it falls back to the previous BASE_SHA..HEAD diff, which can block too much but never passes a PR's own edit. A base that isn't a commit still fails closed.
  • The first version used a three-dot diff. The cadence reviewers found two ways around it: a criss-cross history could pick a merge base that hid the edit, and with HEAD_SHA unset the HEAD^2 guess named main instead of the PR. This design closes both.
• The pr local clean-room guard's tolerant reader is pinned by a test (Closes pr local clean-room guard has no regression test against decoder tightening #504). recordedWorkspaceFor reads breadcrumbs without the strict decoder, so a newer forgectl's record still refuses its workspace. local.go and repair.go now cross-reference the two tolerant readers. This change is test and comments only.
• Dependabot PRs get kind:chore (refs cameronsjo/cadence-ecosystem#553).

Tests

• TestChangelogOwnershipGuardIgnoresMainsOwnReleaseEdit: a release on main under a GitHub-style merge commit passes with both base SHAs.
• New TestChangelogOwnershipGuardCatchesAnEditBehindAMergeFromMain is the negative control: a PR that edits CHANGELOG.md and then merges main in is rejected on both the CI path and the fallback path. It fails against the previous three-dot script. Test helpers now set HEAD_SHA explicitly, so a developer's shell can't change which path runs.
• The existing TestChangelogOwnershipGuard cases still pass, including the invalid-base, hand-edit and Release Please ones.
• TestRecipeAfkBadTargetNamesItsSource, TestResolveRecipeHerdrTarget, and TestPrepareLocal_RefusesCleanRoomFromRecordStrictDecoderRejects, which I mutation-checked.
• gofmt, go vet ./..., go test ./... and golangci-lint v2.13.1 (0 issues) all pass.
• The cadence code-reviewer and security-reviewer both returned CLEAN on the earlier head. Their two changelog-check findings are fixed in 8cd4cba.

Release notes

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wfuj7jLb8eNvEHdxurJgt9

Summary by CodeRabbit

• Bug Fixes
  • Local preparation now blocks workspaces recorded outside the temporary directory, including records created by newer versions.
  • Changelog ownership checks correctly account for release edits on the main branch and changes made in pull requests that merge from it.
• Developer Experience
  • Errors for invalid recipe targets now identify whether the value came from a command-line option or an environment variable.
  • Changelog validation reports an error when its base commit cannot be found.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 71876c44-609f-402e-9d03-b0d5d26256ac

📥 Commits

Reviewing files that changed from the base of the PR and between fa73978 and cfc6b45.

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• changelog_ownership_test.go
• internal/cli/recipe.go
• internal/cli/recipe_test.go
• internal/pr/local.go
• internal/pr/local_test.go
• internal/pr/repair.go
• scripts/check-changelog-owner.sh

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Your free on-demand review promotion remains active until October 9, 2026 at 6:00 PM UTC.

---

📝 Walkthrough

Walkthrough

The pull request updates filtered TUI menu activation, recipe target-source reporting, breadcrumb workspace checks, and changelog ownership comparisons. Tests cover the menu selection, target resolution, workspace refusal, and changelog comparison changes.

Changes

TUI menu activation

Layer / File(s)	Summary
Selected-item dispatch and regression test internal/tui/tui.go, internal/tui/tui_test.go	menuMode dispatches using the selected menuItem label. A regression test verifies that pressing 1 or Enter opens Cheatsheet when filtering leaves it as the only visible row.

Recipe target source reporting

Layer / File(s)	Summary
Target resolution and error reporting internal/cli/recipe.go, internal/cli/recipe_test.go	Target resolution returns the source of the selected value. Target-validation errors identify --target or the environment variable that supplied the value. Tests cover source selection, fallback order, and an invalid environment target that runs no commands.

Breadcrumb workspace guard

Layer / File(s)	Summary
Tolerant workspace lookup and regression test internal/pr/local.go, internal/pr/repair.go, internal/pr/local_test.go	Comments explain why the workspace lookup avoids strict breadcrumb decoding. A test confirms that PrepareLocal refuses a workspace recorded in a newer-version breadcrumb, even when the strict decoder rejects the record.

Changelog ownership guard

Layer / File(s)	Summary
PR-head comparison and merge regression test .github/workflows/ci.yml, scripts/check-changelog-owner.sh, changelog_ownership_test.go	CI passes the PR head SHA to the ownership check. The script compares the base with the selected PR head using a three-dot diff. A regression test covers merge history with a later main release edit.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to cfc6b

The supplied evidence identifies no issue that needs resolution before merge.

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR contains changes unrelated to #496 and #464. The changelog ownership workflow and script changes, their tests, and the breadcrumb handling changes in internal/pr/local.go, `internal/pr/local_…	Remove the changelog ownership and breadcrumb changes from this PR, or move them to separate pull requests. Keep only changes that implement #496, #464, and their supporting tests.
Docstring Coverage	⚠️ Warning	Docstring coverage is 53.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 9 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	⚠️ Warning	The title names several real changes, including the Herdr target source and changelog-owner check. However, it omits the primary filtered-menu fix, includes an unsubstantiated Dependabot-label change,…	Rewrite the title to focus on the primary changes, for example: "fix(tui, recipe): honor filtered menu rows and identify invalid Herdr target sources"

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR meets the coding requirements for #496 and #464. In internal/tui/tui.go, menuMode now dispatches from the filter-aware selected menuItem label. The TUI regression test covers number-key a…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

Full details: Out of Scope Changes check

Explanation

The PR contains changes unrelated to #496 and #464. The changelog ownership workflow and script changes, their tests, and the breadcrumb handling changes in internal/pr/local.go, internal/pr/local_test.go, and internal/pr/repair.go do not implement filtered TUI activation or herdr target validation and source reporting.

Full details: Docstring Coverage

Explanation

Docstring coverage is 53.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 9 files. (1 skipped: 1 unsupported.)

Full details: Title check

Explanation

The title names several real changes, including the Herdr target source and changelog-owner check. However, it omits the primary filtered-menu fix, includes an unsubstantiated Dependabot-label change, and is too long for a concise summary.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{A rabbit taps the filtered row,
And watches Cheatsheet open below.
A target source is named with care,
While newer breadcrumbs guard the lair.
The changelog checks the PR’s own track,
Then bounds along the garden path.}

_{Comment @coderabbitai help to get the list of available commands.}

[cameronsjo]

This PR now conflicts with main. #531 merged first, and both PRs change the filtered tmux menu in internal/tui/tui.go, so merge main in and keep one version of that fix.

One follow-up from #531: the secret masking in internal/exec/mask.go merged without a dedicated security review. It is worth an Opus-level review pass before the next release.

[cameronsjo]

build-test red on 8cd4cba in code this PR doesn't touch. internal/sops's TestIntegration_RoundTripAndDiffShape reported 2 lines changed, want 3 … [llm_key_hermes mac]. The same test passed on main at 6c82c8c and on this PR's previous head 6eb39a1.

Cause: sops writes lastmodified with one-second resolution. If sopsFixture encrypts the file and SetValue edits it within the same second, lastmodified doesn't change, so only the value and mac differ. The test hard-codes 3 changed lines, so it fails whenever both steps land in the same second. That depends on runner speed, not on this PR.

Proposed patch (not applied here, to keep the PR on its issues): assert which lines changed rather than how many.

// internal/sops/driver_test.go, replacing the `changed != 3` check
changed := changedKeys(beforeLines, afterLines)
must := map[string]bool{"llm_key_hermes": true, "mac": true}
may := map[string]bool{"lastmodified": true} // second resolution: unchanged when both steps share a second
for _, k := range changed {
	if !must[k] && !may[k] {
		t.Errorf("unexpected changed line %q: %v", k, changed)
	}
	delete(must, k)
}
for k := range must {
	t.Errorf("expected %q to change: %v", k, changed)
}

I'm re-running the failed job once. No fix for this exists on main yet.

---

Generated by Claude Code

[cameronsjo]

Update: the re-run was refused (403 Resource not accessible by integration), so I applied the patch above instead. The commit is on this branch: the diff-shape test now requires the value and mac lines to change, allows lastmodified, and rejects any other changed line. It compiles, and go vet and golangci-lint are clean. The sops integration leg only runs in CI, where the sops binary is available.

---

Generated by Claude Code