fix(ci): restrict self-hosted PR-Agent comment triggers

.github/workflows/ai-review.yml

@@ -60,13 +60,10 @@ jobs:
         (
           github.event_name == 'issue_comment' &&
           github.event.issue.pull_request &&
-          startsWith(github.event.comment.body, '/') &&
+          github.event.comment.body == '/review' &&
           (
-            github.event.sender.type != 'Bot' ||
-            (
-              github.event.sender.login == 'github-actions[bot]' &&
-              github.event.comment.body == '/review'
-            )
+            contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.comment.author_association) ||
+            github.event.sender.login == 'github-actions[bot]'
           )
         )
       )

CONTRIBUTING.md

@@ -83,6 +83,7 @@ CCS PR review no longer depends on `anthropics/claude-code-action`. The reposito
 - The retained `.github/workflows/ai-review.yml` runs PR-Agent in GitHub Actions.
 - PR-Agent reviews run on the existing self-hosted `cliproxy` runner.
 - Use `/review` on the PR when you need a fresh pass after follow-up commits.
+- Only the trusted `/review` comment path is enabled on the privileged self-hosted runner.
 - Keep repository-level model choice and reviewer instructions in the root `.pr_agent.toml`.
 - Keep automation wiring in `ai-review.yml`, using the workflow env for `OPENAI.*` and `github_action_config.*` settings rather than `.pr_agent.toml`.
 - If you change review defaults, update the workflow or `.pr_agent.toml` alongside the contributor or architecture docs in the same PR.

docs/system-architecture/index.md

@@ -438,7 +438,7 @@ Configured model from `.pr_agent.toml`
 
 - `ai-review.yml` owns automation wiring such as runner selection, PR-Agent action usage, and environment flags like `OPENAI.*` plus `github_action_config.*`.
 - `.pr_agent.toml` in the repo root owns model selection and review instructions for this repository.
-- Contributors should treat PR-Agent comments and `/review` reruns as the primary AI review path for PRs targeting CCS.
+- Contributors should treat PR-Agent comments and trusted `/review` reruns as the primary AI review path for PRs targeting CCS.
 
 ### Runtime Dependencies
 

tests/unit/scripts/github/ai-review-workflow.test.ts

@@ -24,6 +24,8 @@ describe('PR-Agent review lane migration', () => {
     expect(workflow).toContain('OPENAI_KEY');
     expect(workflow).toContain('config.model');
     expect(workflow).toContain('github_action_config.auto_review');
+    expect(workflow).toContain("github.event.comment.body == '/review'");
+    expect(workflow).toContain('github.event.comment.author_association');
     expect(workflow).not.toContain('uses: anthropics/claude-code-action@v1');
     expect(workflow).not.toContain('AI_REVIEW_API_KEY');