ci(bonk): restore substantive Kumo reviews

[mattrothenberg]

Summary

• configure kumo through OpenCode's supported default_agent setting instead of Bonk's legacy agent input
• pin the CI-only small model to avoid the unavailable Haiku title-model request
• make the Kumo agent explicitly primary and require contextual inspection and relevant validation for reviews
• fail closed to a restricted read-only tool policy for fork PRs, preventing execution or exfiltration through attacker-controlled package scripts

Validation

• pnpm exec vp fmt --check .github/workflows/bonk.yml .opencode/agents/kumo.md

• git diff --check -- .github/workflows/bonk.yml .opencode/agents/kumo.md

• branch-scoped Bonk run: https://github.com/cloudflare/kumo/actions/runs/34244933982

• confirmed review execution used agent: "kumo"

• confirmed title and review requests used Kimi K2.6 with no Haiku 404

• confirmed Bonk produced a contextual validation summary before LGTM!

• verified permission selection for non-PR, same-repo PR, fork PR, and GitHub API failure cases; fork and failure cases deny shell, edits, subagents, external files, network fetches, LSP, and skills

• removed the temporary pull_request trigger after the successful run

• Reviews

• bonk has reviewed the change

• automated review not possible because:

• Tests

• Tests included/updated

• Automated tests not possible - manual testing has been completed as follows: ran the PR-scoped Bonk workflow and verified Kumo agent/model selection, then exercised all fork-permission selector paths including fail-closed API failure

• Additional testing not necessary because:

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://mattr-fix-bonk-reviews-kumo-docs.design-engineering.workers.dev (commit 49b1941)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://9870c898-kumo-docs.design-engineering.workers.dev	49b1941	2026-09-08T16:46:15.635Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://6d8f9818-kumo-docs.design-engineering.workers.dev	5363f1f	2026-09-08T15:37:24.152Z	Visit the dashboard ↗
Build: In progress 🔵 View logs ↗		252eb7c	2026-09-08T15:28:27.062Z	View logs ↗
Build: In progress 🔵 View logs ↗		a8615a5	2026-09-08T15:24:24.392Z	View logs ↗

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/kumo@782

commit: 49b1941

[ask-bonk]

I have thoroughly reviewed the pull request. The changes are scoped to two files:

1..github/workflows/bonk.yml — migrates the workflow from the legacy agent input to default_agent inside OPENCODE_CONFIG_CONTENT, pins the CI-only small model to avoid an unavailable Haiku request, and adds temporary pull_request: [synchronize] scaffolding (properly branch-gated to mattr/fix-bonk-reviews).

2..opencode/agents/kumo.md — adds mode: primary to the agent frontmatter and introduces a detailed "Code Reviews" section that aligns with the project's existing review conventions.

I validated the YAML syntax, JSON validity, formatting (pnpm exec vp fmt --check), and whitespace (git diff --check). All pass. The temporary triggers are appropriately scoped and commented. The OPENCODE_CONFIG_CONTENT JSON is well-formed, and the migration from agent: kumo to default_agent: kumo is consistent with the stated intent.

I do not see any actionable regressions introduced by this change.

LGTM!

github run

[github-actions]

Docs Preview

View docs preview

Commit: 4d44ef2

[mattrothenberg]

/bonk please approve via the GitHub UI ✅

[ask-bonk]

LGTM!

github run

[github-actions]

📐 Bundle Size

Consumer fixtures bundled against packages/kumo/dist (peers external, minified ESM).

Fixture	Raw	Gzip	Brotli
Button (root)	177.6 KB	50.5 KB	43.5 KB
Button (components/button)	177.5 KB	50.4 KB	43.6 KB
Button + Dialog + Select (root)	300.5 KB	86.1 KB	72.1 KB
Button + Dialog + Select (component subpaths)	300.5 KB	86.1 KB	71.9 KB
Chart (root)	218.6 KB	63.0 KB	54.4 KB
Chart (components/chart)	218.6 KB	63.0 KB	54.4 KB
Badge (components/badge)	44.7 KB	11.7 KB	10.1 KB
Flow (components/flow)	208.9 KB	58.3 KB	50.6 KB
Button (primitives/button)	11.8 KB	4.3 KB	3.8 KB
Primitives barrel	650.8 KB	178.6 KB	139.9 KB
Code highlighting (code)	2.08 MB	468.3 KB	349.5 KB

npm tarball: 517 files, 1.44 MB packed, 6.75 MB unpacked.

⚠️ 22 flagged files in tarball (tests / raw scripts)

• dist/blocks-source/resource-list/resource-list.test.tsx
• scripts/component-registry/cache.ts
• scripts/component-registry/discovery.ts
• scripts/component-registry/example-cleanup.ts
• scripts/component-registry/index.test.ts
• scripts/component-registry/index.ts
• scripts/component-registry/markdown-generator.ts
• scripts/component-registry/metadata.ts
• scripts/component-registry/props-filter.ts
• scripts/component-registry/schema-generator.ts
• scripts/component-registry/sub-components.ts
• scripts/component-registry/types.ts
• scripts/component-registry/utils.ts
• scripts/component-registry/variant-parser.ts
• scripts/css-build.ts
• scripts/generate-primitives.ts
• scripts/theme-generator/config.ts
• scripts/theme-generator/generate-css.test.ts
• scripts/theme-generator/generate-css.ts
• scripts/theme-generator/index.ts
• scripts/theme-generator/migrate.ts
• scripts/theme-generator/types.ts

Report-only: no size thresholds are enforced yet.

Commit: 49b19413