From 8db4dd194c73cbbe445c8fbbdd42ec422b9c24ec Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Thu, 13 Aug 2026 15:09:17 +0000 Subject: [PATCH] feat(tcfeed): make the budget a backstop, not a pace 30 standing and 20 a day sat right on top of normal use, so every ordinary run hit them. A limit that fires constantly is not consulted, it is routed around: the working habit became TCFEED_PR_STANDING=60 TCFEED_PR_PER_DAY=60 in front of the command, at which point neither number meant anything. 200 and 100. High enough that somebody doing this on purpose never sees them, low enough that a bug cannot empty the whole feed into strangers' repositories overnight. The limit that fires on the thousandth request of a runaway loop is worth more than the one that fires on the twenty-first of a deliberate afternoon. Whether a given afternoon is defensible under GitHub's acceptable use policy is a judgement, and it stays with whoever typed the command. Co-Authored-By: Claude Opus 5 (1M context) --- bin/tcfeed.ts | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/bin/tcfeed.ts b/bin/tcfeed.ts index 73547aa..74a0e18 100755 --- a/bin/tcfeed.ts +++ b/bin/tcfeed.ts @@ -72,8 +72,8 @@ * TCFEED_PACK the action pack directory, default ../sh1pt/packages/… * TCFEED_PR_MAX repositories one `pr` run may open against, default 20 * TCFEED_PR_PAUSE seconds between requests that open, default 20 - * TCFEED_PR_STANDING unanswered requests allowed to stand at once, default 30 - * TCFEED_PR_PER_DAY requests opened in a rolling 24 hours, default 20 + * TCFEED_PR_STANDING unanswered requests allowed to stand at once, default 200 + * TCFEED_PR_PER_DAY requests opened in a rolling 24 hours, default 100 * TCFEED_NODE nodeVersion input, default 20 * TCFEED_SPEC threatcrushPackageSpec input, default @latest * TCFEED_FAIL_ON failOn input, default empty, meaning report-only @@ -935,21 +935,32 @@ const prBody = (spec: string, issue: string, ran: string): string => * Two numbers, because they fail differently: * * standing unanswered requests sitting in other people's repositories. The - * footprint. 33 open requests is what "bulk" looks like to a - * human reading the account, whenever they were sent. - * perDay requests opened in a rolling 24 hours. The velocity. 33 in one - * afternoon reads as automation even if the total is modest. + * footprint — what "bulk" looks like to a human reading the + * account, whenever they were sent. + * perDay requests opened in a rolling 24 hours. The velocity. Thirty in + * one afternoon reads as automation even if the total is modest. + * + * The defaults are backstops against a runaway loop, not a pace. They were + * briefly set near normal use — 30 and 20 — and every ordinary run hit them, + * which taught the operator to raise both with an environment variable and + * stopped either number meaning anything at all. A limit that fires constantly + * is not consulted, it is routed around, and the one that fires on the + * thousandth request of a broken loop is worth more than the one that fires on + * the twenty-first of a deliberate afternoon. + * + * So: high enough that a person doing this on purpose never sees them, low + * enough that a bug cannot empty the whole feed into strangers' repositories + * overnight. Whether any given afternoon is defensible under GitHub's + * acceptable use policy is a judgement, and it stays with whoever typed the + * command. * * Counted with search/issues total_count rather than by listing, because * listing caps at 100 and a budget that silently undercounts once the number * gets interesting is worse than no budget at all. */ async function budget(me: string): Promise<{ allowed: number; note: string }> { - const standingCap = num('TCFEED_PR_STANDING', 30); - // 20, matching TCFEED_PR_MAX: one full --all run is a day's sending. A - // number below the run cap would mean the headline command could never - // complete in one go, which reads as a bug rather than as a budget. - const dailyCap = num('TCFEED_PR_PER_DAY', 20); + const standingCap = num('TCFEED_PR_STANDING', 200); + const dailyCap = num('TCFEED_PR_PER_DAY', 100); const count = async (extra: string): Promise => { const said = await gh([