Repository navigation
Harden SDK schema-driven input fidelity and package preflight - #499
Conversation
Deliver a broad SDK/CLI package-author safety bundle across template custom fields, repeatable extension and acceptance-criteria flags, dependency graph validation, and reserved item-field preflight. Add public SDK contracts, full regression coverage, documentation, generated contracts/changelog, and pm evidence for pm-kfq5, pm-l6rz, pm-zazb, pm-b84u, and pm-ghf1.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
@greptileai review /gemini review @coderabbitai full review |
|
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 59 minutes. |
📝 WalkthroughWalkthroughThe PR updates repeatable CLI option handling, validates dependency shorthand before parsing, preserves template custom fields, accumulates extension list aliases, exports reserved item-field names, and rejects reserved blueprint fields during SDK linting. ChangesCLI and SDK correctness fixes
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Bot feedback disposition (initial pass):
I will reply inline to every substantive finding and rerun reviewers after any head update. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a comprehensive set of input fidelity and package-author safety improvements across the CLI and SDK. Key changes include accumulating repeated acceptance criteria flags, preserving custom type-option fields in templates, rejecting malformed dependency shorthand values early to prevent dangling graph edges, allowing extension list flags to accumulate repeated occurrences, and validating extension blueprints against reserved item-field name collisions. The reviewer feedback recommends expanding the template-declared custom options filter to support booleans and numbers to prevent silent data loss, and adding defensive type guards when linting item fields to avoid runtime crashes on malformed blueprints.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Code Review
This pull request implements a broad schema-driven input fidelity and package-author safety bundle. Key changes include allowing repeated --ac flags to accumulate (joined by "; "), preventing malformed dependency shorthand from creating dangling graph edges, ensuring templates map custom type-option fields correctly, and adding SDK linting to reject extension fields that shadow reserved metadata keys. The review feedback highlights two important safety improvements: adding nullish coalescing guards to prevent a potential runtime TypeError when iterating over optional typeDefinition.options in create.ts, and filtering out nullish values when merging repeated list flag occurrences in extension-command-options.ts to avoid inserting undefined or null elements into the coerced array.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Greptile SummaryThis PR hardens CLI and SDK input handling for schema-driven item creation and package authoring. The main changes are:
Confidence Score: 5/5Safe to merge with minimal risk. The updated paths are focused on CLI option normalization, SDK preflight, dependency validation, docs, and tests. No verified runtime, schema, or security issues remain in the reviewed changes. No files require special attention.
 T-Rex LogsWhat T-Rex did
Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant User
participant CLI as CLI Commander/loose parser
participant Normalizer as Registration helpers / SDK boundary
participant Validator as Schema + dependency validators
participant Runtime as Create/Update/Extension runtime
User->>CLI: Provide repeatable aliases, template options, deps, extension flags
CLI->>CLI: Accumulate repeatable aliases in shared parser state
CLI->>Normalizer: Pass parsed options with ordered occurrences
Normalizer->>Normalizer: Canonicalize aliases and join acceptance criteria once
Normalizer->>Validator: Validate type options, dependency shorthand, reserved fields
Validator-->>User: Usage error for malformed deps or reserved collisions
Validator->>Runtime: Normalized schema-safe options
Runtime->>Runtime: Create/update item or invoke extension command
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant User
participant CLI as CLI Commander/loose parser
participant Normalizer as Registration helpers / SDK boundary
participant Validator as Schema + dependency validators
participant Runtime as Create/Update/Extension runtime
User->>CLI: Provide repeatable aliases, template options, deps, extension flags
CLI->>CLI: Accumulate repeatable aliases in shared parser state
CLI->>Normalizer: Pass parsed options with ordered occurrences
Normalizer->>Normalizer: Canonicalize aliases and join acceptance criteria once
Normalizer->>Validator: Validate type options, dependency shorthand, reserved fields
Validator-->>User: Usage error for malformed deps or reserved collisions
Validator->>Runtime: Normalized schema-safe options
Runtime->>Runtime: Create/update item or invoke extension command
Reviews (20): Last reviewed commit: "fix(cli): preserve extension list alias ..." | Re-trigger Greptile |
Regenerate the runtime contract fixture from a clean build so Commander-owned repeatability is represented by distinct --acceptance-criteria and --ac entries. Record the CI correction and verification evidence in pm-b84u.
Greptile SummaryThis PR hardens SDK and CLI input handling for schema-driven create/update flows. The main changes are:
Confidence Score: 4/5This PR has one contained create-path bug that should be fixed before merging. Most changes are centralized and covered, but duplicate template/explicit type-option keys currently persist the wrong value. src/cli/commands/create.ts
T-Rex LogsWhat T-Rex did
Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant User
participant Commander
participant CreateUpdate as create/update commands
participant SDK as SDK validators/contracts
participant Schema as Runtime schema/extensions
participant Store as Item store
User->>Commander: pass repeatable aliases, template, deps, fields
Commander->>CreateUpdate: normalized option payload
CreateUpdate->>SDK: validate dependency shorthand / contract aliases
CreateUpdate->>Schema: resolve item type, template type options, reserved fields
Schema-->>CreateUpdate: validated metadata + type options
CreateUpdate->>Store: write item/history or update item
Store-->>User: result with changed fields/warnings
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant User
participant Commander
participant CreateUpdate as create/update commands
participant SDK as SDK validators/contracts
participant Schema as Runtime schema/extensions
participant Store as Item store
User->>Commander: pass repeatable aliases, template, deps, fields
Commander->>CreateUpdate: normalized option payload
CreateUpdate->>SDK: validate dependency shorthand / contract aliases
CreateUpdate->>Schema: resolve item type, template type options, reserved fields
Schema-->>CreateUpdate: validated metadata + type options
CreateUpdate->>Store: write item/history or update item
Store-->>User: result with changed fields/warnings
Prompt To Fix All With AIFix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
src/cli/commands/create.ts:1460
**Preserve explicit overrides**
`--template` defaults currently override an explicit `--type-option` for the same key. `parseTypeOptionEntries` is last-wins, and this appends `templateTypeOptions` after `resolvedOptions.typeOption`, so `pm create --template agent --type-option agentStatus=running` stores the template's `agentStatus` instead of the caller's explicit value.
```suggestion
resolvedOptions.typeOption = [...templateTypeOptions, ...(resolvedOptions.typeOption ?? [])];
```
Reviews (2): Last reviewed commit: "feat(sdk): harden schema-driven input fi..." | Re-trigger Greptile |
Regenerate the package-owned changelog after the final tracker evidence and closeout so its ordering reflects the canonical pm end state.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
Head updated with the fresh-build contract snapshot correction and final package-owned changelog ordering. Re-running all review agents on commit @greptileai review /gemini review @coderabbitai full review |
|
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 53 minutes. |
|
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 52 minutes. |
There was a problem hiding this comment.
Code Review
This pull request implements a comprehensive input fidelity and package-author safety bundle. Key changes include accumulating repeated --ac flags into a single joined string, supporting accumulation of repeated extension list flags, rejecting malformed dependency shorthand to prevent dangling graph edges, mapping template-declared custom type options, and linting against reserved item-field name collisions. The review feedback identifies several critical improvement opportunities: allowing non-string primitives for template-declared custom type options, ensuring alias keys are cleaned up and undefined values are handled defensively in extension option coercion, restoring fallback label logic for loose options, and adding defensive checks to prevent runtime crashes when linting blueprints with malformed item fields.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/COMMANDS.md`:
- Around line 412-413: Move the explanatory paragraph beginning “Repeat
--ac/--acceptance-criteria” outside the surrounding bash code fence in the
documentation, placing it after the closing fence so it renders as prose rather
than a shell command.
In `@src/cli/commands/create.ts`:
- Around line 1456-1464: Only remove template option keys that were actually
transferred into typeOption. In the templateTypeOptions handling near
resolvedOptions.typeOption, derive the deletion set from options passing the
existing string-value filter, then delete only those keys; preserve non-string
values on resolvedOptions rather than iterating over every
typeDefinition.options entry.
In `@src/core/extensions/item-fields.ts`:
- Around line 11-12: Keep the mutable reserved-name Set private instead of
exporting RESERVED_ITEM_FIELD_NAMES directly, and expose a genuinely
non-mutating facade or membership helper for consumers. Update all references to
use that API, and add a regression test confirming mutation attempts cannot
alter reserved-field checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: e396ddf1-8828-436e-be60-f5c8330f49dd
📒 Files selected for processing (31)
.agents/pm/extensions/.managed-extensions.json.agents/pm/history/pm-b84u.jsonl.agents/pm/history/pm-ghf1.jsonl.agents/pm/history/pm-kfq5.jsonl.agents/pm/history/pm-l6rz.jsonl.agents/pm/history/pm-zazb.jsonl.agents/pm/issues/pm-b84u.toon.agents/pm/issues/pm-ghf1.toon.agents/pm/issues/pm-kfq5.toon.agents/pm/issues/pm-l6rz.toon.agents/pm/issues/pm-zazb.toonCHANGELOG.mddocs/COMMANDS.mddocs/EXTENSIONS.mddocs/SDK.mdsrc/cli/commands/create.tssrc/cli/commands/templates.tssrc/cli/commands/update.tssrc/cli/extension-command-options.tssrc/cli/registration-helpers.tssrc/core/extensions/item-fields.tssrc/sdk/cli-contracts/commander-mutation-options.tssrc/sdk/compose.tssrc/sdk/dependency-flag-validation.tssrc/sdk/index.tstests/fixtures/contracts/full.jsontests/unit/cli/registration-helpers.spec.tstests/unit/commands/create-command.spec.tstests/unit/commands/update-command.spec.tstests/unit/extensions/extension-command.spec.tstests/unit/sdk/sdk-compose.spec.ts
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Preserve explicit type-option precedence over primitive template defaults, guard malformed reserved-field blueprints, and filter nullish list alias values. Add focused regressions, document template precedence, refresh pm evidence, and regenerate the package-owned changelog.
Expose reserved item-field names through a non-mutating ReadonlySet facade, canonicalize scalar aliases without leaking duplicate keys, and fix command-guide rendering. Add full facade and alias regressions, record bot dispositions in pm, and regenerate the final changelog.
|
All substantive findings on the previous head have been dispositioned inline, reacted to, and resolved after verification. Final review-fix head: Re-running every review agent because the head changed: @greptileai review /gemini review @coderabbitai full review |
There was a problem hiding this comment.
Code Review
This pull request implements a broad schema-driven input fidelity and package-author safety bundle. Key changes include: allowing repeated --ac flags to accumulate into a single joined string; accumulating repeated extension list flags instead of dropping values; promoting template-declared custom type options into validated typeOption entries; rejecting malformed dependency shorthand before prefix normalization; and linting declarative blueprints to reject reserved item-field name collisions. Feedback on the PR highlights a potential issue where template-declared custom option keys colliding with core CLI options (like title or type) could be deleted from resolvedOptions, causing silent data loss or validation failures. A code suggestion is provided to safeguard core option keys.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Combine scalar and collected values across every Commander acceptance-criteria alias so mixed --acceptance-criteria, --acceptance_criteria, and --ac usage cannot lose data. Add create/update regressions and final pm evidence.
|
Greptile P1 on mixed repeatable aliases is fixed, reacted to, replied inline, and resolved on @greptileai review /gemini review @coderabbitai full review |
|
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 59 minutes. |
There was a problem hiding this comment.
Code Review
This pull request introduces broad schema-driven input fidelity and package-author safety improvements across the SDK and CLI, including repeatable acceptance criteria accumulation, malformed dependency shorthand validation, template-declared custom type option mapping, and reserved item-field collision checks in extension blueprints. A critical review comment points out that in readJoinedRepeatedOption, unprovided alias keys initialized as undefined will cause the function to prematurely return undefined and discard valid values, and suggests skipping nullish values to prevent silent data loss.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Exclude canonical create-option keys from template custom-option promotion and delete only successfully matched custom primitives. Add a colliding title regression and record final Gemini evidence in pm.
|
Disposition for Gemini final-head quota notice #499 (comment): acknowledged. The daily quota prevented another pass; all earlier Gemini findings were fixed, explicitly verified, and the final head is independently green across the complete gate matrix. |
|
Final disposition for CodeRabbit confirmation #499 (comment): acknowledged and recorded; documentation rendering remains correct on the final head. |
|
Final disposition for CodeRabbit confirmation #499 (comment): acknowledged and recorded; the immutable reserved-field facade remains verified on the final head. |
|
Final disposition for CodeRabbit confirmation #499 (comment): acknowledged and recorded; primitive template options and explicit precedence remain verified on the final head. |
…ase-health evidence - GH-498 -> pm-z32q (comments --body alias + unknown-option flag hints), related-linked to pm-g543/pm-gdi7 - pm-801d: S1-S4 decomposition note (rebuild/staleness substrate first) as wave-2 entry proposal - pm-wenq: resolution-faucet evidence 272->277 after PR #499 closures - pm-7zs0: first fully-clean release cycle post-recovery - pm-doxj: pass summary + next-pass leads Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PdSrzeajwhyHXopGC7GB5p
Summary
list: trueflags preserve values across mixed long and short aliases--acvalue through Commander and normalize it once at the SDK boundaryProject management
pm-kfq5pm-l6rzpm-zazbpm-b84upm-ghf1--repos a --repos bsilently keeps only the last #496The five related items were claimed, implemented as one coherent SDK/CLI package-authoring bundle, fully evidenced through
pm, closed, and released. No unrelated item remains in progress.Verification
pnpm buildpnpm typecheckpnpm lint(ESLint, zero-copy jscpd, docstring/import-boundary/token-efficiency gates)node scripts/run-tests.mjs coverage: 5,514 tests, 100% statements, branches, functions, and linespm test --run --progresspnpm docs:checkpnpm skills:checkpnpm contracts:checkpnpm audit --audit-level highpnpm security:scanpnpm changelog:pm && pnpm changelog:pm:checkusingpm-changelog2026.7.10@unbrained/pm-cliinto a fresh temporary project; verified repeated acceptance criteria, malformed-dependency rejection, and public SDK reserved-field lintingpm health --check-only --summary --json: healthy, zero warningspm validate --check-resolution --check-history-drift --json: zero history drift; existing repository resolution-metadata warnings remain unchangedObservability
Telemetry coverage is healthy with no missing error codes. The Sentry release gate continues to identify
PM-CLI-1YandPM-CLI-1Z, handled spawn errors originating in the externalpm-starterpackage's legacypm --path ...calls; this change neither introduces nor masks those external-package events.Summary by cubic
Hardens schema-driven input fidelity and SDK preflight to prevent silent data loss and dangling deps. Repeatable parsers and coercion now preserve argv order across aliases; templates apply custom scalar options safely;
--depshorthands validate early.list: trueaccumulate repeated long/short alias values and comma lists using one shared accumulator across visible/hidden aliases; parse occurrence provenance is carried into coercion so interleaved aliases keep exact argv order through CSV flatten; accumulators reset per parse; nullish alias values are ignored; arrays are deduped; scalar aliases canonicalize without duplicate keys (pm-kfq5, SDK/host: extension flags declared as lists don't accumulate repeated values —--repos a --repos bsilently keeps only the last #496).--acceptance-criteria/--acceptance_criteria/--acaccumulate in argv order and are joined with;once at the SDK boundary; Commander-null/undefined alias keys are ignored; the runtime contract lists distinct repeatable aliases, and templates keep it scalar to avoid double-joining (pm-b84u).--type-optionpipeline; explicit type-option inputs override primitive template defaults; template custom options no longer override canonical create fields; non-scalar custom values are rejected while scalar string/number/boolean are accepted (pm-l6rz, Templates silently drop tags and custom type-option fields on create (built-ins like priority/assignee apply) #497).--depshorthand is guarded; malformed inputs likerelated:pm-abcdfail fast with anid=<id>,kind=<kind>hint on both create and update (pm-zazb).RESERVED_ITEM_FIELD_NAMESas a non‑mutating ReadonlySet with standard iterator methods; lint/preflight/harness reject blueprint item-field names that collide with core metadata keys (pm-ghf1).Written for commit 7400595. Summary will update on new commits.