v3.108.0

[zaynahsmith-dasilva]

Background

Changes

Testing

[cursor]

PR Summary

Medium Risk
Adds a new Anthropic detection pack and a custom pre-commit wrapper that runs the external claude CLI, which can affect developer workflow and commit reliability. Also removes the GitHub Actions Claude PR review workflow, changing automated review coverage in CI.

Overview
Adds a new Anthropic.Activity detection set (multiple rule .py/.yml pairs) plus global_helpers/panther_anthropic_helpers to standardize actor identification and alert context across these rules.

Reworks agent/tooling docs by introducing AGENTS.md, trimming CLAUDE.md to point to it, and adding Claude Code command/skill docs for PR review and detection scaffolding; also updates generated indexes for Anthropic coverage.

Changes local developer workflow by installing a custom .git/hooks/pre-commit wrapper (via make install-pre-commit-hooks) that runs .scripts/claude_review.py before pre-commit, and removes the .github/workflows/claude_review_pr.yml Claude PR review automation and legacy Cursor rule docs.

^{Reviewed by Cursor Bugbot for commit fe45cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Regex extracts nested type instead of top-level type

Low Severity

_extract_update_type uses re.search to find the first 'type': '...' match in a serialized dict string. The docstring claims serializing each entry individually avoids capturing nested type values, but that's incorrect — nested objects within each entry are still part of its str() output. If JSON field ordering places a nested object before the top-level type key (e.g., {"current_value": [{"type": "github"}], "type": "vcs_connections"}), the regex matches the nested "github" instead of "vcs_connections". Only affects title() display, not detection logic.

 

^{Reviewed by Cursor Bugbot for commit b326ddf. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fe45cce. Configure here.}

[cursor]

New global helper module has no unit tests

Medium Severity

The new panther_anthropic_helpers.py module has no corresponding test file and no tests in global_helpers_test.py. The repo's own AGENTS.md §14 states "Adding new helper modules requires adding corresponding *_test.py files; make global-helpers-unit-test enforces this." Every other helper imported in global_helpers_test.py has test coverage, but panther_anthropic_helpers is absent. Both anthropic_actor_id (with its or-chaining fallback logic) and anthropic_alert_context (with its optional-context filtering) contain logic worth validating.

 

^{Reviewed by Cursor Bugbot for commit fe45cce. Configure here.}