Operations
Security model
Understand credentials, code execution, trust boundaries, and the merge boundary.
Credentials
- CURSOR_API_KEY starts and resumes cloud agents.
- GITHUB_TOKEN reads PRs and checks and writes labels and comments.
- Private clone credentials are temporary and never enter clone URLs.
- Tokens are not included in migration prompts.
Configured commands are trusted code
setupCommand and testCommand execute in a disposable clone. Treat patchflow.config.json as code: review changes to it and restrict who may edit the configuration used by unattended watch mode.
Important
Isolation protects the working tree, not the host account. Run PatchFlow in a dedicated CI worker or container for stronger process and network isolation.
Human merge boundary
PatchFlow opens draft PRs and never merges. Repository branch protection and required human approval remain the final authority.
Output handling
Gate output is truncated before storage, PR comments, and agent retry prompts. Avoid tests that print credentials; PatchFlow cannot reliably redact arbitrary application output.