Repository navigation
Harden init target safety and package install verification - #491
Conversation
Ignore unknown JavaScript scorer weight keys, aggregate only canonical evaluation metrics, and reject missing or non-finite threshold values in both the public SDK and external corpus gate. Add focused regression coverage and record the review-fix evidence in the active pm items.
Add explicit workspace/tracker init target contracts and executable scoped follow-ups. Make package installation activation diagnostics authoritative, return non-zero failures, and include compact post-install verification. Cover path isolation, SDK recovery, contracts, docs, tracker lifecycle hygiene, and package-owned changelog generation with exact 100% coverage and packed-install proof.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
📝 WalkthroughWalkthroughThe PR adds workspace-aware ChangesInit targeting and scoped commands
Package installation verification
Context evaluation hardening
Project tracking
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CLI as pm CLI
participant Init as init command
participant Extension as extension installer
participant Runtime as extension runtime
CLI->>Init: resolve workspace or tracker target
Init->>Extension: install bundled packages at tracker root
Extension->>Runtime: probe loading and activation
Runtime-->>Extension: activation status and diagnostics
Extension-->>CLI: verification and failure details
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@greptileai review |
|
/gemini review |
|
@coderabbitai full review |
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 59 minutes. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces workspace-local tracker initialization via the new --workspace option for pm init, ensuring that follow-up commands are properly scoped with --pm-path when discovery is unavailable. It also hardens package installation by introducing a post-install verification summary, ensuring that runtime activation failures result in non-zero exit codes and provide actionable recovery steps (such as when @unbrained/pm-cli is unresolvable). Additionally, context evaluation gates and weight overrides are hardened against non-finite thresholds and unknown keys. Feedback on the changes suggests safeguarding string operations on activationFailure.error to prevent potential runtime crashes if the error property is undefined or not a string.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Greptile SummaryThis PR hardens
Confidence Score: 5/5Safe to merge with low risk. The changed paths consistently scope init package installs, reject unsafe tracker targets, and propagate activation failures through result objects and exit codes. Tests cover the main changed workflows, including prior review findings. No files require special attention.
 T-Rex LogsWhat T-Rex did
Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant User
participant Init as pm init
participant Resolver as Target resolver
participant Tracker as Target tracker
participant Installer as pm install all
participant Runtime as Extension runtime probe
User->>Init: init [prefix/path] [--workspace] [--with-packages]
Init->>Resolver: resolve workspace/tracker target
Resolver-->>Init: target mode + tracker_root
Resolver-->>Init: target mode + tracker_root
Init->>Tracker: create settings/schema/type folders
alt --with-packages
Init->>Installer: runExtension("all", --project, --pm-path tracker_root)
Installer->>Tracker: install bundled packages
Installer->>Runtime: load + activate installed packages
Runtime-->>Installer: activation status, commands/actions/types, health
Installer-->>Init: installed_all / failed aliases / verification
end
Init-->>User: result with target + scoped next_steps
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant User
participant Init as pm init
participant Resolver as Target resolver
participant Tracker as Target tracker
participant Installer as pm install all
participant Runtime as Extension runtime probe
User->>Init: init [prefix/path] [--workspace] [--with-packages]
Init->>Resolver: resolve workspace/tracker target
Resolver-->>Init: target mode + tracker_root
Resolver-->>Init: target mode + tracker_root
Init->>Tracker: create settings/schema/type folders
alt --with-packages
Init->>Installer: runExtension("all", --project, --pm-path tracker_root)
Installer->>Tracker: install bundled packages
Installer->>Runtime: load + activate installed packages
Runtime-->>Installer: activation status, commands/actions/types, health
Installer-->>Init: installed_all / failed aliases / verification
end
Init-->>User: result with target + scoped next_steps
Reviews (5): Last reviewed commit: "fix(packages): preserve failure truth ac..." | Re-trigger Greptile |
Greptile SummaryThis PR hardens
Confidence Score: 5/5Safe to merge with low risk. The reviewed paths consistently thread resolved tracker roots into writes, package installs, runtime probes, and follow-up commands. Runtime load and activation failures now produce failed install results and matching diagnostics. No blocking correctness or security issues were identified. No files require special attention.
T-Rex LogsWhat T-Rex did
Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant User
participant Init as pm init
participant Tracker as Resolved tracker root
participant Install as pm install all
participant Loader as Extension loader/activator
participant Output as Result/verification
User->>Init: "init [target|--workspace|--pm-path] [--with-packages]"
Init->>Init: Resolve target contract and guard workspace-root --pm-path
Init->>Tracker: Create dirs/settings/schema/guidance
alt --with-packages
Init->>Install: runExtension("all", --project, --pm-path tracker)
loop bundled package alias
Install->>Tracker: Copy package and update managed state/settings
Loader-->>Install: activation status, commands, actions, item types, failures
end
Install-->>Init: aggregate ok/failed counts and verification payloads
end
Init->>Output: Scoped next steps and concise init result
Output-->>User: ok or non-zero failure with diagnostics
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant User
participant Init as pm init
participant Tracker as Resolved tracker root
participant Install as pm install all
participant Loader as Extension loader/activator
participant Output as Result/verification
User->>Init: "init [target|--workspace|--pm-path] [--with-packages]"
Init->>Init: Resolve target contract and guard workspace-root --pm-path
Init->>Tracker: Create dirs/settings/schema/guidance
alt --with-packages
Init->>Install: runExtension("all", --project, --pm-path tracker)
loop bundled package alias
Install->>Tracker: Copy package and update managed state/settings
Loader-->>Install: activation status, commands, actions, item types, failures
end
Install-->>Init: aggregate ok/failed counts and verification payloads
end
Init->>Output: Scoped next steps and concise init result
Output-->>User: ok or non-zero failure with diagnostics
Reviews (1): Last reviewed commit: "feat(init): harden package verification ..." | Re-trigger Greptile |
There was a problem hiding this comment.
Code Review
This pull request introduces workspace-local tracker initialization via a new --workspace option for pm init, scopes emitted next-step commands with --pm-path when workspace discovery is unavailable, and adds a post-install verification summary to pm install results. It also ensures non-zero CLI exit codes on installation failures, hardens the public context relevance scorer against unknown override keys, and validates evaluation thresholds as finite numbers. Review feedback recommends safeguarding against potential runtime TypeErrors and serialization issues in src/cli/commands/extension.ts by safely converting failure errors to strings and using optional chaining on activationFailure.error.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Resolve PR #491 CodeQL alert 16 by exercising multiple dollar characters and using a complete replacement in the regression expectation. Record the security follow-up in pm, close and release the canonical item, and regenerate the package-owned changelog.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/EXTENSIONS.md`:
- Line 45: Update the documentation sentence near the explicit “--pm-path”
guidance to replace “package dogfood” with the standard wording “package
dogfooding” or “package testing,” without changing the surrounding meaning.
In `@tests/unit/commands/init-command.spec.ts`:
- Around line 119-125: Update the expected-string builder in the
buildInitNextSteps test to escape every dollar sign in replacementSensitivePath,
not just the first; use a global replacement so paths containing multiple "$"
characters remain correctly asserted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 873eaaed-b441-482c-8153-8f14e60db2f2
📒 Files selected for processing (57)
.agents/pm/epics/pm-mpbb.toon.agents/pm/epics/pm-n7rr.toon.agents/pm/epics/pm-usfg.toon.agents/pm/features/pm-3mna.toon.agents/pm/features/pm-4k6b.toon.agents/pm/features/pm-atfm.toon.agents/pm/features/pm-cbwg.toon.agents/pm/features/pm-oxrw.toon.agents/pm/features/pm-x6jf.toon.agents/pm/features/pm-yjim.toon.agents/pm/features/pm-zwpp.toon.agents/pm/history/pm-3mna.jsonl.agents/pm/history/pm-3wsi.jsonl.agents/pm/history/pm-4k6b.jsonl.agents/pm/history/pm-atfm.jsonl.agents/pm/history/pm-b3e9.jsonl.agents/pm/history/pm-cbwg.jsonl.agents/pm/history/pm-ixoa.jsonl.agents/pm/history/pm-lixy.jsonl.agents/pm/history/pm-m4iu.jsonl.agents/pm/history/pm-mpbb.jsonl.agents/pm/history/pm-n7rr.jsonl.agents/pm/history/pm-oxrw.jsonl.agents/pm/history/pm-qt5d.jsonl.agents/pm/history/pm-usfg.jsonl.agents/pm/history/pm-w89s.jsonl.agents/pm/history/pm-x26a.jsonl.agents/pm/history/pm-x6jf.jsonl.agents/pm/history/pm-yjim.jsonl.agents/pm/history/pm-zwpp.jsonl.agents/pm/issues/pm-3wsi.toon.agents/pm/issues/pm-ixoa.toon.agents/pm/issues/pm-m4iu.toon.agents/pm/issues/pm-qt5d.toon.agents/pm/issues/pm-x26a.toon.agents/pm/stories/pm-w89s.toon.agents/pm/tasks/pm-b3e9.toon.agents/pm/tasks/pm-lixy.toonCHANGELOG.mddocs/COMMANDS.mddocs/EXTENSIONS.mddocs/SDK.mdscripts/release/context-eval-gate.mjssrc/cli/commands/extension.tssrc/cli/commands/init.tssrc/cli/register-setup.tssrc/sdk/cli-contracts/flag-contracts.tssrc/sdk/context-relevance.tstests/fixtures/contracts/full.jsontests/integration/init-path-guard.integration.spec.tstests/integration/package-command-discovery.integration.spec.tstests/integration/release-readiness-runtime.spec.tstests/unit/commands/init-command.spec.tstests/unit/commands/register-commands.spec.tstests/unit/extensions/extension-command.spec.tstests/unit/scripts/release/context-eval-gate.spec.tstests/unit/sdk/context-relevance.spec.ts
|
@greptileai review |
|
/gemini review |
|
@coderabbitai full review |
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 44 minutes. |
There was a problem hiding this comment.
Code Review
This pull request introduces several enhancements to the CLI initialization and package installation workflows. Key changes include adding a --workspace option to pm init to initialize repository-local tracker storage, scoping emitted follow-up commands with --pm-path when workspace discovery is unavailable, and integrating a post-install verification summary into pm install results with proper failure exit codes. Additionally, the context evaluation gate was hardened to validate thresholds and ignore unknown weight keys. The review feedback correctly identifies potential runtime TypeErrors due to unsafe property access on activationFailure.error and entry.result.details, and highlights a potential race condition from mutating global process.env inside an asynchronous function.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@coderabbitai Follow-up on comments 4932637463, 4932639153, and 4932733498: both actionable inline findings were acknowledged. The repeated-dollar regression is fixed and the public wording now says package testing. The repository static-quality gate, not the bot heuristic, verifies the enforced docstring thresholds. |
|
@greptileai Follow-up on summaries 4932667086 and 4932668276: the reproduced multi-target diagnostic loss was valid and is fixed with unit plus real-CLI coverage. The clean second summary was also useful corroboration; the newer inline P1s are being addressed on the next head. |
|
Codecov report 4932683901 acknowledged: all modified coverable lines were covered. A fresh full exact 100/100/100/100 run is in progress for the additional review fixes. |
|
Review-body acknowledgments: GitHub Advanced Security found the valid repeated-dollar CodeQL issue and it is fixed. Gemini reviews 4669121846 and 4669140541 were declined because the producer types require normalized string errors; review 4669194939 also identified the valid process-environment concurrency concern, now fixed with FIFO serialization. CodeRabbit review 4669150393 is addressed. Greptile reviews 4669197502 and 4669204068 produced actionable P1 regressions now covered by failing-first tests. Sourcery review 4669103621 was rate-limited and contained no code finding. |
|
Thanks for closing the loop. Glad the multi-target diagnostic loss reproduction was actionable — unit + real-CLI coverage is the right level of confidence for that kind of aggregation path. The second summary corroborating the fix is a good signal too. Understood on the inline P1s moving to the next head. Nothing blocking merge from the findings raised in those two summaries then. |
|
Tip For best results, initiate chat on the files or code changes.
✏️ Learnings added
|
Summary
pm init, including executable--pm-path-scoped follow-upsinit --with-packageswrites to the resolved target trackerok,activated, exit codes, aggregation, diagnostics, and SDK recovery guidanceCloses #488
Closes #473
Root causes
Path-target init output assumed workspace discovery and bundled installs inherited caller globals. Package installation also treated file copy as success even when runtime load or activation failed, producing contradictory result fields and a zero exit status.
Verification
node scripts/run-tests.mjs coverage: 270 files, 5,505 tests, exact 100/100/100/100pm test-all --status in_progress --progress: 8 passed, 0 failed, 1 duplicate-safe skippnpm typecheckpnpm contracts:checkpnpm lint: ESLint, 0 jscpd clones, static quality, token budgeta05e5598-76c0-4e44-b255-a7e41fb356f2: confidence 5/5, no commentspm health --check-only --summary: clean; history drift: 0Tracker
Completed:
pm-x26a,pm-3wsi,pm-yjim,pm-qt5d,pm-b3e9. Broader context work returned to open/unclaimed; no pm items remain in progress.Summary by cubic
Hardens
pm inittarget safety and adds compact post‑install package verification. Preserves multi‑target install diagnostics, enforces non‑zero exits on degraded/disabled verification, and serializes package probing; includes runnable, tracker‑scoped next steps (addresses GH‑488, GH‑473) and fixes a CodeQL‑reported shell‑sensitive path case.New Features
pm init --workspace <dir>creates<dir>/.agents/pm; a positional path keeps tracker‑root mode. Result includestarget(mode,tracker_root,workspace_root?) andnext_stepsthat carry--pm-path.pm installreturns averificationsummary (activation, registered commands/actions/types, target root, health).ok: falseorverification.status: "degraded"fails the install.@unbrained/pm-cli.Bug Fixes
init --with-packagesand project installs to the resolved tracker; guard positional path targets from repository‑root writes.Written for commit eed4df3. Summary will update on new commits.