Repository navigation
Harden agent UX, package contracts, and calendar errors - #71
Conversation
Continue active pm-rnpb/pm-7rlp remediation with a single combined PR scope. Changes: - add telemetry-informed command/option recovery for common agent mistakes - make package extension usage errors produce deterministic CLI envelopes and avoid Sentry exception noise - validate calendar package output format conflicts before execution - publish the SDK runtime subpath and align bundled package capabilities/contracts - invalidate local LanceDB snapshot cache when backing files change or disappear - keep focused regression coverage for command recovery, schema shorthand, package manifests, Sentry helper behavior, and vector-store cache invalidation Verification: - PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/integration/help-runtime.spec.ts tests/unit/calendar-command.spec.ts tests/unit/package-manifest.spec.ts tests/unit/schema-command.spec.ts tests/unit/sdk-index.spec.ts tests/unit/sentry-helpers.spec.ts tests/unit/vector-store-adapter.spec.ts --reporter=dot - manual isolated temp-project walkthrough with PM_PATH/PM_GLOBAL_PATH - pm package doctor --project --detail deep --json - pnpm changelog:pm:check - node scripts/release/run-gates.mjs --telemetry-mode required --max-sentry-critical 10 --max-sentry-high 20 --max-telemetry-error-rate 10 --json
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
@codex review Please review the combined active-work PR for agent UX recovery, package/runtime contracts, calendar extension error handling, LanceDB local snapshot cache invalidation, tracker hygiene, and verification coverage. |
|
Warning Review limit reached
More reviews will be available in 44 minutes and 7 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (13)
📒 Files selected for processing (15)
📝 WalkthroughWalkthroughThis PR introduces SDK runtime export, improves CLI help/error recovery for unknown commands and options, enhances calendar and schema command validation, implements snapshot-aware vector store caching, removes deprecated CLI contracts, and updates search extension manifest capabilities. It also includes extensive tracker audit and verification evidence across multiple PM tracking files. ChangesCode Enhancements and CLI Improvements
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces several improvements to the CLI's extensibility, error recovery, and vector store caching. Key changes include publishing the ./sdk/runtime subpath, adding telemetry-informed command aliases and semantic option suggestions, allowing schema shorthand definitions, and implementing backing-file change detection for the LanceDB local snapshot cache. The review feedback highlights a critical issue in src/cli/main.ts where standard Node.js errors with a code property might bypass graceful exit-code handling due to an overly broad Commander error check. Additionally, opportunities to optimize the LanceDB cache reload logic when snapshot stats are missing and to simplify the dedupeStrings helper were identified.
| const hasCommanderCode = typeof error === "object" && error !== null && "code" in error; | ||
| if ( | ||
| error instanceof PmCliError || | ||
| (!hasCommanderCode && typeof numericExitCode === "number" && Number.isFinite(numericExitCode)) | ||
| ) { |
There was a problem hiding this comment.
The check const hasCommanderCode = typeof error === "object" && error !== null && "code" in error; is too broad. Many standard Node.js errors (such as SystemError with code: "ENOENT") or custom package/extension errors will have a code property. Because of this, any such error that also defines a numericExitCode will be incorrectly classified as having a Commander code, causing it to bypass this if block. This leads to the error being treated as an unexpected crash (logged to Sentry and exiting with code 1) instead of being gracefully handled with its designated exit code.
To fix this, we should specifically check if the code property is a string that starts with "commander.".
const isCommanderError =
typeof error === "object" &&
error !== null &&
"code" in error &&
typeof (error as { code?: unknown }).code === "string" &&
(error as { code: string }).code.startsWith("commander.");
if (
error instanceof PmCliError ||
(!isCommanderError && typeof numericExitCode === "number" && Number.isFinite(numericExitCode))
)| if (cached && !snapshotStats) { | ||
| const loaded = new Map<string, VectorRecord>(); | ||
| lanceDbLocalTables.set(key, { records: loaded, mtimeMs: null, size: null }); | ||
| return loaded; | ||
| } |
There was a problem hiding this comment.
When snapshotStats is null (meaning the backing file is missing), and cached is already defined with mtimeMs === null, this block unnecessarily creates a new Map and overwrites the cache on every single call. We can optimize this by returning cached.records directly if cached.mtimeMs is already null.
if (cached && !snapshotStats) {
if (cached.mtimeMs === null) {
return cached.records;
}
const loaded = new Map<string, VectorRecord>();
lanceDbLocalTables.set(key, { records: loaded, mtimeMs: null, size: null });
return loaded;
}| function dedupeStrings(values: string[]): string[] { | ||
| const seen = new Set<string>(); | ||
| const result: string[] = []; | ||
| for (const value of values) { | ||
| if (seen.has(value)) { | ||
| continue; | ||
| } | ||
| seen.add(value); | ||
| result.push(value); | ||
| } | ||
| return result; | ||
| } |
There was a problem hiding this comment.
The custom dedupeStrings function can be simplified and made more idiomatic by using Array.from(new Set(...)) or the spread operator with Set.
function dedupeStrings(values: string[]): string[] {
return [...new Set(values)];
}
There was a problem hiding this comment.
Code Review
This pull request introduces several enhancements to the CLI's extensibility, usability, and robustness. Key changes include exposing the ./sdk/runtime subpath, removing optional package-owned commands from the core SDK command enum and contracts, adding command aliases and semantic option suggestions for common user mistakes, allowing schema shorthand when options make the intent clear, and implementing cache invalidation for LanceDB local snapshots based on file stats. Review feedback suggests optimizing the LanceDB snapshot loading logic to avoid unnecessary read attempts when the file is missing, and correcting the exit code normalization in src/cli/main.ts to prevent negative exit codes from being incorrectly mapped to success.
| const cached = lanceDbLocalTables.get(key); | ||
| if (cached) { | ||
| return cached; | ||
| if (cached && !snapshotStats) { | ||
| const loaded = new Map<string, VectorRecord>(); | ||
| lanceDbLocalTables.set(key, { records: loaded, mtimeMs: null, size: null }); | ||
| return loaded; | ||
| } | ||
| if ( | ||
| cached && | ||
| snapshotStats && | ||
| cached.mtimeMs === snapshotStats.mtimeMs && | ||
| cached.size === snapshotStats.size | ||
| ) { | ||
| return cached.records; | ||
| } |
There was a problem hiding this comment.
We can optimize this block by checking !snapshotStats first. If the snapshot file does not exist (i.e., snapshotStats is null), we can immediately return an empty map and cache it. This avoids an unnecessary readFile call that is guaranteed to throw an ENOENT error, simplifying the logic and improving I/O efficiency.
const cached = lanceDbLocalTables.get(key);
if (!snapshotStats) {
const loaded = new Map<string, VectorRecord>();
lanceDbLocalTables.set(key, { records: loaded, mtimeMs: null, size: null });
return loaded;
}
if (
cached &&
cached.mtimeMs === snapshotStats.mtimeMs &&
cached.size === snapshotStats.size
) {
return cached.records;
}| (!hasCommanderCode && typeof numericExitCode === "number" && Number.isFinite(numericExitCode)) | ||
| ) { | ||
| const errorMessage = describeUnknownError(error); | ||
| const exitCode = error instanceof PmCliError ? error.exitCode : Math.max(0, Math.trunc(numericExitCode as number)); |
There was a problem hiding this comment.
Using Math.max(0, ...) on numericExitCode will map any negative exit codes (which represent errors) to 0 (success). This can cause CI/CD pipelines or calling scripts to incorrectly assume the command succeeded. We should instead cast the exit code to an unsigned 8-bit integer using & 0xFF, which matches Node.js's native exit code handling behavior for negative values (e.g., -1 becomes 255).
| const exitCode = error instanceof PmCliError ? error.exitCode : Math.max(0, Math.trunc(numericExitCode as number)); | |
| const exitCode = error instanceof PmCliError ? error.exitCode : (Math.trunc(numericExitCode as number) & 0xFF); |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/pm/extensions/.managed-extensions.json:
- Line 3: This change directly edits the system-of-record file
`.agents/pm/extensions/.managed-extensions.json` (the "updated_at" field), which
must not be modified by hand; revert this direct edit and regenerate/update the
file using the `pm` workflow/tooling instead (do not commit manual changes to
`.agents/pm/**`), ensuring the commit only contains the workflow-triggered
output; reference the file name `.agents/pm/extensions/.managed-extensions.json`
and the "updated_at" field when making the correction.
In @.agents/pm/history/pm-7rlp.jsonl:
- Around line 70-84: This PR includes direct edits to the tracker history JSON
(pm-7rlp claims/comments/updated_at patches) which must not be changed in
source; revert all changes that modify the tracker JSON entries (the JSON
objects containing
"author":"codex-full-audit"/"codex-full-manual-audit"/"ci-quality-subagent" and
any patches that replace "/metadata/assignee", "/metadata/updated_at" or add to
"/metadata/comments") so the .agents/pm history stays untouched, and instead
record those updates through the PM system workflow (do not reintroduce edits to
the tracker JSON in the branch).
In @.agents/pm/history/pm-rnpb.jsonl:
- Around line 631-658: The change directly edited system-of-record history
entries (JSON ops like "comment_add", "claim", "release" touching
metadata.comments, metadata.assignee and metadata/updated_at) which must not be
modified by hand; revert these direct edits and remove this file from the PR,
then reapply any intended audit/metadata updates using the official pm
workflow/tooling (e.g., the pm history/pm CLI commands or the repo's pm-agent
APIs) so the entries are recorded via the supported "pm" processes rather than
manual JSON edits.
In `@src/cli/main.ts`:
- Line 1670: When wrapping non-Error throws before calling
sentryCaptureCliError, preserve any exitCode from the original throw so
shouldCaptureCliError's filtering still works: detect when the thrown value is
not an Error, create a new Error using errorMessage (as currently done) but copy
exitCode (and any other relevant numeric exit properties) from the original
thrown value onto the new Error before passing it to sentryCaptureCliError;
update the call site around sentryCaptureCliError and references to errorMessage
so that the constructed error retains original.exitCode for
shouldCaptureCliError to inspect.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 68f631da-186e-4740-a59c-a2bf5a7fb0e9
📒 Files selected for processing (37)
.agents/pm/chores/pm-7rlp.toon.agents/pm/chores/pm-ch59.toon.agents/pm/decisions/pm-3cbk.toon.agents/pm/extensions/.managed-extensions.json.agents/pm/features/pm-59gj.toon.agents/pm/features/pm-gt82.toon.agents/pm/features/pm-rnpb.toon.agents/pm/history/pm-3cbk.jsonl.agents/pm/history/pm-59gj.jsonl.agents/pm/history/pm-7rlp.jsonl.agents/pm/history/pm-8nyc.jsonl.agents/pm/history/pm-ch59.jsonl.agents/pm/history/pm-gt82.jsonl.agents/pm/history/pm-rnpb.jsonl.agents/pm/issues/pm-8nyc.toonpackage.jsonpackages/pm-calendar/extensions/calendar/index.jspackages/pm-calendar/extensions/calendar/index.tspackages/pm-calendar/extensions/calendar/runtime.jspackages/pm-calendar/extensions/calendar/runtime.tspackages/pm-search-advanced/extensions/search-advanced/index.jssrc/cli/commander-usage.tssrc/cli/main.tssrc/cli/register-mutation.tssrc/core/search/vector-stores.tssrc/core/sentry/helpers.tssrc/sdk/cli-contracts.tssrc/sdk/cli-contracts/enum-contracts.tstests/helpers/cliRunner.tstests/helpers/withTempPmPath.tstests/integration/help-runtime.spec.tstests/unit/calendar-command.spec.tstests/unit/package-manifest.spec.tstests/unit/schema-command.spec.tstests/unit/sdk-index.spec.tstests/unit/sentry-helpers.spec.tstests/unit/vector-store-adapter.spec.ts
💤 Files with no reviewable changes (2)
- src/sdk/cli-contracts/enum-contracts.ts
- src/sdk/cli-contracts.ts
| { | ||
| "version": 1, | ||
| "updated_at": "2026-05-25T17:44:26.878Z", | ||
| "updated_at": "2026-05-25T20:36:02.725Z", |
There was a problem hiding this comment.
Avoid direct edits to system-of-record tracker files under .agents/pm.
This PR includes direct content changes under .agents/pm (Line 3 here and similar updates across other .agents/pm/* files). Please regenerate/update these via the pm workflow instead of direct file edits.
As per coding guidelines, .agents/pm/**: pm is the system of record. Do not edit .agents/pm files directly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/pm/extensions/.managed-extensions.json at line 3, This change
directly edits the system-of-record file
`.agents/pm/extensions/.managed-extensions.json` (the "updated_at" field), which
must not be modified by hand; revert this direct edit and regenerate/update the
file using the `pm` workflow/tooling instead (do not commit manual changes to
`.agents/pm/**`), ensuring the commit only contains the workflow-triggered
output; reference the file name `.agents/pm/extensions/.managed-extensions.json`
and the "updated_at" field when making the correction.
| {"ts":"2026-05-25T19:30:51.137Z","author":"codex-full-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/assignee","value":"codex-full-audit"},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:30:51.137Z"}],"before_hash":"37f94d42ea12269795348c96c422491cf21af1162c2ea57e0dee2438526b7da5","after_hash":"965acbf8babda62aea978f4f383472743434cb253c4110c67bb47a2ece781514","message":"2026-05-25 CI/test performance continuation under full audit"} | ||
| {"ts":"2026-05-25T19:47:35.952Z","author":"codex-full-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/26","value":{"created_at":"2026-05-25T19:47:35.952Z","author":"codex-full-audit","text":"CI/test performance findings from this pass: static quality gate is green and focused tests pass, but the suite still overuses subprocess CLI calls (sub-agent counted ~815 runCli uses vs 4 runCliInProcess uses) and full coverage remains gated by a high-friction manifest/allowlist. Local package-first dogfood passed, with slowest operations roughly 1.0-2.1s in temp projects. I added focused regression tests rather than broad slow integration coverage: help-runtime error recovery, calendar package validation, package manifest capability/export checks, LanceDB snapshot cache invalidation, and SDK core-command boundary assertions. Remaining work for this item should migrate high-volume integration clusters to in-process runner and dedupe release/auto-release workflow gates."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:47:35.952Z"}],"before_hash":"965acbf8babda62aea978f4f383472743434cb253c4110c67bb47a2ece781514","after_hash":"5e1f5eb1eeb657185c12f98f374318fe53633bfee432ed204ba0ed0ac20be714"} | ||
| {"ts":"2026-05-25T19:51:01.868Z","author":"codex-full-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:51:01.868Z"}],"before_hash":"5e1f5eb1eeb657185c12f98f374318fe53633bfee432ed204ba0ed0ac20be714","after_hash":"c63d4aef4a519e547ca5b2626acdc6c226c54af4208b865e0a2059aa2d379042","message":"Continue CI/test performance lane during full audit"} | ||
| {"ts":"2026-05-25T19:53:04.737Z","author":"codex-gh-ci-dependency-triage","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/27","value":{"created_at":"2026-05-25T19:53:04.737Z","author":"codex-gh-ci-dependency-triage","text":"Read-only GitHub/CI/dependency triage 2026-05-25:\n\nScope honored: no source/workflow/package edits; only tracker evidence appended. Started from pm-rnpb and pm-7rlp, then checked current open items. Reused pm-7rlp for CI/test findings; no duplicate item created.\n\nGitHub state:\n- gh issue list --state open --limit 50 --json ... => [] (no open issues).\n- gh pr list --state open --limit 50 --json ... => [] (no open PRs).\n- gh run list --limit 20 --json ... => latest main CI run 26416020351 on f47901c completed success; previous main run 26415948706 was cancelled by concurrency after newer push.\n- gh api repos/:owner/:repo/dependabot/alerts => all returned alerts are state=fixed; no open Dependabot security alert found.\n- gh api repos/:owner/:repo/secret-scanning/alerts => [] (no secret-scanning alerts returned).\n- pnpm audit --audit-level moderate --json => 0 low/moderate/high/critical vulnerabilities across 281 total dependencies.\n- gh api repos/:owner/:repo/code-scanning/alerts could not be used in this token/session: API reported no analysis found and requested admin:repo_hook scope. Treat code-scanning as not verified by this pass.\n\nCI/workflow findings:\n- ci.yml current topology matches pm-7rlp direction: build-foundation on Ubuntu Node 20, runtime smoke matrix, and gates matrix for coverage/typecheck/static/compat/smokes. No duplicate full pnpm test in PR/push runtime matrix observed.\n- Auto Release recent scheduled failures 26353906615 and 26387640606 are already covered by closed pm-yf8t. Logs show dist/cli.js MODULE_NOT_FOUND before the build step existed. Current main has ae3d884e adding Build before Run auto release pipeline, so this pass did not reopen it; next scheduled run should be watched for confirmation.\n- Nightly Validation is still red and maps to this item: latest run 26390994985 failed only on windows-latest Node 20; ubuntu Node 20/22/24/25 and macOS Node 20 jobs passed. Windows failures: tests/unit/check-secrets.spec.ts suite SyntaxError, tests/integration/release-automation-contract.spec.ts SyntaxError in tracker-only release relevance test, tests/integration/cli.integration.spec.ts spawnSync npm ENOENT at npm pack, and tests/unit/package-manifest.spec.ts generated runtime loader drift for pm-beads/pm-todos on Windows. This confirms cross-platform nightly remains the active CI follow-up under pm-7rlp.\n\nDependency/update notes:\n- dependabot.yml is present for npm and github-actions weekly Monday 04:00 UTC, grouped minor/patch updates, open PR limit 5.\n- gh pr list currently shows no open Dependabot PRs, but remote refs still include historical dependabot branches; no action needed without an open PR.\n\nCommands/evidence used include: git status --short --branch; pm get pm-rnpb --json; pm get pm-7rlp --json; pm list-open --json; gh auth status; gh repo view --json nameWithOwner,defaultBranchRef,isPrivate,url,latestRelease,securityPolicyUrl,pushedAt,viewerPermission; gh issue list; gh pr list; gh run list; gh run view 26387640606 --json/--log-failed; gh run view 26390994985 --json/--log-failed; gh api dependabot/alerts; gh api secret-scanning/alerts; gh api dependency-graph/sbom; pnpm audit --audit-level moderate --json; sed over .github workflows and dependabot.yml; package.json script inspection.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:53:04.737Z"}],"before_hash":"c63d4aef4a519e547ca5b2626acdc6c226c54af4208b865e0a2059aa2d379042","after_hash":"c560719c082a5e26a7a903f88ebc2c1a9aac9188fcb36fc3aae1e82ee9b7b56d"} | ||
| {"ts":"2026-05-25T20:08:30.929Z","author":"codex-code-quality-specialist","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/28","value":{"created_at":"2026-05-25T20:08:30.929Z","author":"codex-code-quality-specialist","text":"Code-quality specialist evidence 2026-05-25: bounded gates mostly pass but CI/test performance and coverage are not healthy. Commands: pnpm typecheck passed elapsed=4.211s; node scripts/release/static-quality-gate.mjs --json passed elapsed=2.600s; pnpm quality:docs-skills passed elapsed=10.270s; node scripts/check-secrets.mjs passed elapsed=1.263s; PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- --reporter=dot passed 121 files / 1804 tests elapsed=284.904s. Full serial coverage command PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs coverage -- --reporter=dot --testTimeout 120000 --maxWorkers 1 failed after elapsed=652.964s: Vitest reported coverage/.tmp disappeared, and coverage-summary.json shows total lines 99.87, statements 99.88, branches 99.72 with src/core/search/vector-stores.ts below 100%. Recommended fix: add focused coverage for current LanceDB cache branches in vector-stores.ts, then rerun coverage; also make run-tests/coverage use an isolated reportsDirectory or preflight lock/cleanup so long coverage runs cannot collide with stale or concurrent coverage state."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:08:30.929Z"}],"before_hash":"c560719c082a5e26a7a903f88ebc2c1a9aac9188fcb36fc3aae1e82ee9b7b56d","after_hash":"ea971dc39f9b433f37823469c4b216aab2c136c3c9fd26081cffe02913f93e8f","message":"Record current test and coverage findings"} | ||
| {"ts":"2026-05-25T20:14:23.440Z","author":"codex-full-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/29","value":{"created_at":"2026-05-25T20:14:23.440Z","author":"codex-full-audit","text":"Final verification 2026-05-25: CI/test quality gate restored after vector-store coverage regression. Full release gate passed with 121 files / 1806 tests / 100% coverage. Remaining performance work stays open: sub-agent evidence shows most wall time is bootstrap/module/extension loading and high-volume integration tests still overuse subprocess runCli compared with runCliInProcess."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:14:23.440Z"}],"before_hash":"ea971dc39f9b433f37823469c4b216aab2c136c3c9fd26081cffe02913f93e8f","after_hash":"b8f68952f51a6aa5a158ad2133ace4cb8c420ca4850ef269ca4b75534dde1bf8"} | ||
| {"ts":"2026-05-25T20:14:28.211Z","author":"codex-full-audit","op":"release","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:14:28.211Z"}],"before_hash":"b8f68952f51a6aa5a158ad2133ace4cb8c420ca4850ef269ca4b75534dde1bf8","after_hash":"a62b0d3774d9bcc85027deaf33a47f739e59e7dcd25cb40003c5bc85e860390b","message":"Release active CI/test claim after full gate"} | ||
| {"ts":"2026-05-25T20:18:15.051Z","author":"codex-full-manual-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:18:15.051Z"},{"op":"add","path":"/metadata/assignee","value":"codex-full-manual-audit"}],"before_hash":"a62b0d3774d9bcc85027deaf33a47f739e59e7dcd25cb40003c5bc85e860390b","after_hash":"9cea50a7a98cae259e3fd45c26f9e0f231766c0a41b45235fc04851645491f01","message":"Resume CI/test performance lane during full audit"} | ||
| {"ts":"2026-05-25T20:19:46.311Z","author":"ci-quality-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/30","value":{"created_at":"2026-05-25T20:19:46.311Z","author":"ci-quality-subagent","text":"CI/test quality sub-agent start 2026-05-25: ran pm context/search/list-open/list-in-progress; reusing pm-7rlp for CI/test performance and pm-3cbk for large-module/coverage maintainability. Scope: inspect latest dirty checkout, package scripts, Vitest config, CLI runner usage, current diff, and focused quality gates without reverting others' work."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:19:46.311Z"}],"before_hash":"9cea50a7a98cae259e3fd45c26f9e0f231766c0a41b45235fc04851645491f01","after_hash":"797ffaa89c4f79874cc7f797927c2c6c8741bab798a79828c9e4b05a31aaa846"} | ||
| {"ts":"2026-05-25T20:23:34.500Z","author":"ci-quality-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/31","value":{"created_at":"2026-05-25T20:23:34.500Z","author":"ci-quality-subagent","text":"CI/test quality sub-agent final evidence 2026-05-25: inspected package scripts, vitest.config.ts, tests/helpers/cliRunner.ts, tests/helpers/withTempPmPath.ts, scripts/run-tests.mjs, .github/workflows/ci.yml, .github/workflows/nightly.yml, current diff, GitHub open PR/issues/runs, dependency audit, and runCli usage. Findings: CI topology already uses the right dedupe shape for PR/push (build-foundation, runtime dist smoke matrix, coverage/typecheck/static/compat/smokes gates) and nightly keeps full OS/Node breadth; no open PRs or issues; latest main CI run 26416020351 completed success; pnpm audit found no known vulnerabilities. Remaining performance issue is test-suite subprocess overuse: 822 context.runCli calls vs 4 runCliInProcess calls and 6 direct dist helper calls, so pm-7rlp should stay open for broad migration of high-volume integration specs. Local verification from this pass: pnpm typecheck PASS 6.271s before helper edit and PASS 11.024s after helper edit; static-quality-gate PASS 4.722s; check-secrets PASS 1.817s; focused changed-surface test command PASS 9 files / 129 tests / 30 skipped in 58.812s; stdin append focused command PASS 1 file / 5 tests / 9 skipped in 21.521s. I made one scoped test-helper type fix: tests/helpers/withTempPmPath.ts now includes input in the runCli closure options so it matches TempPmContext and the subprocess runner contract. I did not rerun full coverage because codex-full-audit had just recorded full release gate success with 1806 tests and 100% coverage after the vector-store fix, and this pass only added tracker evidence plus a helper typing fix covered by typecheck/focused stdin tests."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:23:34.500Z"}],"before_hash":"797ffaa89c4f79874cc7f797927c2c6c8741bab798a79828c9e4b05a31aaa846","after_hash":"ff25b3e8aa6300bdce4e2c1339da3cc67dc59cf489e361a4afdfa3f85b3cb179"} | ||
| {"ts":"2026-05-25T20:25:22.810Z","author":"manual-dogfood-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/32","value":{"created_at":"2026-05-25T20:25:22.810Z","author":"manual-dogfood-subagent","text":"Manual linked-test evidence: initial test add with command=npm test was rejected by sandbox safety until both PM_PATH and PM_GLOBAL_PATH were explicit; after adding explicit env and making the temp test emit expected stdout, pm test --run passed in 1739ms and pm test-all passed in 1697ms with linked_tests=1 passed=1 failed=0. This confirms safety guardrails work, but test commands are still subprocess-bound and around 1.7s for a tiny node smoke."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:25:22.810Z"}],"before_hash":"ff25b3e8aa6300bdce4e2c1339da3cc67dc59cf489e361a4afdfa3f85b3cb179","after_hash":"ed6a50593b571ce5fea2e3f43b0ee5618ac98191f60372bd55c3056e48f0e8ed"} | ||
| {"ts":"2026-05-25T20:28:24.347Z","author":"observability-security-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/33","value":{"created_at":"2026-05-25T20:28:24.347Z","author":"observability-security-subagent","text":"CI/automation evidence from observability-security subagent 2026-05-25: latest main CI run 26416020351 succeeded for commit f47901c with all jobs green. Historical same-day failures reviewed for context: Auto Release 26387640606 failed because release pipeline ran before dist existed; current auto-release workflow now includes `pnpm build` before `node scripts/release/run-release-pipeline.mjs`. Nightly 26390994985 failed only on Windows Node 20 with npm spawn/runtime-loader sync/syntax failures; later main CI is green. CI 26397135725 failed static gate in changelog extension handling; later main CI static gate succeeded. Dependabot update 26384310873 failed in upstream updater for an action update and left no open alert. No new CI source edits made by this subagent.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:28:24.347Z"}],"before_hash":"ed6a50593b571ce5fea2e3f43b0ee5618ac98191f60372bd55c3056e48f0e8ed","after_hash":"16356cc8884b3b6e5b6b32932cd89ff958b3e623479d273c32243167fd146f20"} | ||
| {"ts":"2026-05-25T20:29:24.942Z","author":"codex-full-manual-audit","op":"release","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:29:24.942Z"}],"before_hash":"16356cc8884b3b6e5b6b32932cd89ff958b3e623479d273c32243167fd146f20","after_hash":"faa6136256f60a523ab41e686a1d71611631424639e732ecf18f699b5d6020d5","message":"Release CI/test performance claim after validation"} | ||
| {"ts":"2026-05-25T20:35:04.969Z","author":"codex-active-continuation","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:35:04.969Z"},{"op":"add","path":"/metadata/assignee","value":"codex-active-continuation"}],"before_hash":"faa6136256f60a523ab41e686a1d71611631424639e732ecf18f699b5d6020d5","after_hash":"f9366723fcc3940e04723ddbcab5acb5299badba0c5082e8be30c2ceed3a42cd","message":"Continue CI/test performance verification within combined PR"} | ||
| {"ts":"2026-05-25T20:37:01.129Z","author":"github-dependency-security-scout","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/34","value":{"created_at":"2026-05-25T20:37:01.129Z","author":"github-dependency-security-scout","text":"CI-specific GitHub scout evidence 2026-05-25 (read-only aside from tracker comment): latest main CI run 26416020351 succeeded for f47901c. Recent failed runs reviewed with gh run view/logs: CI 26397135725 failed Gates(static) in changelog generate extension handler, then later main CI went green; Nightly 26390994985 failed only Windows Node 20 with check-secrets/release-relevance SyntaxError, spawnSync npm ENOENT in packed extension test, and generated runtime-loader drift; Auto Release 26387640606 failed before build existed with Cannot find module dist/cli.js, matching the now-addressed build-before-release-pipeline fix; Dependabot Updates 26384310873 failed in upstream updater on softprops/action-gh-release unknown_error, while setup-node/upload-artifact were already latest. Blocker assessment for current PR: do not block on these historical failures because latest main CI is green and no open PR/check is red; keep pm-7rlp open for the Windows/runner and subprocess-portability performance work if not already fully resolved.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:37:01.129Z"}],"before_hash":"f9366723fcc3940e04723ddbcab5acb5299badba0c5082e8be30c2ceed3a42cd","after_hash":"c27a50feda4aa35a6fd29153395e57a9bf0b2e4648d023634a9a4a460e808923"} |
There was a problem hiding this comment.
Remove direct tracker-history edits from this PR.
This file is under .agents/pm/**, which must not be directly modified. Please drop these history-line changes from the code PR and record tracker updates through the PM system workflow instead.
As per coding guidelines, .agents/pm/**: pm is the system of record. Do not edit .agents/pm files directly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/pm/history/pm-7rlp.jsonl around lines 70 - 84, This PR includes
direct edits to the tracker history JSON (pm-7rlp claims/comments/updated_at
patches) which must not be changed in source; revert all changes that modify the
tracker JSON entries (the JSON objects containing
"author":"codex-full-audit"/"codex-full-manual-audit"/"ci-quality-subagent" and
any patches that replace "/metadata/assignee", "/metadata/updated_at" or add to
"/metadata/comments") so the .agents/pm history stays untouched, and instead
record those updates through the PM system workflow (do not reintroduce edits to
the tracker JSON in the branch).
| {"ts":"2026-05-25T19:30:51.159Z","author":"codex-full-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/assignee","value":"codex-full-audit"},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:30:51.159Z"}],"before_hash":"b408fe7728766e1f150412db8d0ae5583e415cc76a638ac27045974e1559b20b","after_hash":"f7f5d694a6f2bc711fefa67ab844a1fac181da05ff4dfbac54af9b89789622f6","message":"2026-05-25 full manual/sub-agent audit and remediation pass"} | ||
| {"ts":"2026-05-25T19:31:07.496Z","author":"codex-full-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/282","value":{"created_at":"2026-05-25T19:31:07.496Z","author":"codex-full-audit","text":"Execution start 2026-05-25 full manual/sub-agent audit: duplicate-check/orientation completed with pm health summary, pm list-in-progress, pm list-open, and broad pm search. Reusing canonical active items pm-rnpb and pm-7rlp; no duplicate item created. Spawned specialized sub-agents for manual temp-project dogfood/agent UX, SDK/package extensibility, semantic/vector search, calendar/reminders, CI/test performance, and code-quality/security/dead-code review. Local workstream is handling GitHub, telemetry/Sentry, tracker hygiene, integration, and any safe fixes discovered.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:31:07.496Z"}],"before_hash":"f7f5d694a6f2bc711fefa67ab844a1fac181da05ff4dfbac54af9b89789622f6","after_hash":"85cf7109513980eca9568b608c52d721aa2f9caddd53f59ccc99dc678aa36981"} | ||
| {"ts":"2026-05-25T19:47:35.967Z","author":"codex-full-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/283","value":{"created_at":"2026-05-25T19:47:35.966Z","author":"codex-full-audit","text":"Full manual/sub-agent remediation pass 2026-05-25: spawned specialized sub-agents for manual dogfood/agent UX, SDK/package extensibility, search/vector indexing, calendar, CI/test performance, and code quality/security. External checks found no open GitHub PRs/issues, no Dependabot/secret-scanning alerts, latest main CI green, Sentry/telemetry gate passing with 4 unresolved high Sentry issue groups and telemetry showing repeated user mistakes around show/comment/search/list/config plus high p95 latency for mutation commands. Implemented this pass: telemetry-informed unknown command aliases (show->get, comment->comments, note->notes, learning->learnings), semantic option recovery for comments/notes/learnings --body/--text style mistakes, extension package exitCode handling so package usage errors produce deterministic pm envelopes, calendar package validation for invalid formats/json conflicts/repeated views, LanceDB local snapshot cache invalidation when external processes delete/replace the backing file, search-advanced module capability parity, optional package command removal from core SDK command enum/static contracts, and public ./sdk/runtime export for package runtimes. Manual temp-project dogfood passed normal create/comment/notes/search flows and validated the new recovery messages. Package-first dogfood passed 84 commands, and semantic dogfood passed 86 commands against qwen3-embedding:0.6b."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:47:35.967Z"}],"before_hash":"85cf7109513980eca9568b608c52d721aa2f9caddd53f59ccc99dc678aa36981","after_hash":"bcd3c4af1594136da63f76810000eeb90686509ad9e07c3f6d3e0fa950e8afe2"} | ||
| {"ts":"2026-05-25T19:50:58.684Z","author":"codex-full-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:50:58.684Z"}],"before_hash":"bcd3c4af1594136da63f76810000eeb90686509ad9e07c3f6d3e0fa950e8afe2","after_hash":"b67f52a0ba62c49f5cf755294115cac3eb3a977d56f23d4454d49350c803a49b","message":"Continue full manual audit and remediation with specialist sub-agent lanes"} | ||
| {"ts":"2026-05-25T19:53:14.284Z","author":"codex-gh-ci-dependency-triage","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/284","value":{"created_at":"2026-05-25T19:53:14.284Z","author":"codex-gh-ci-dependency-triage","text":"GitHub/CI/dependency triage summary 2026-05-25 (read-only specialist lane): no open GitHub issues or PRs; no open Dependabot security alerts returned; secret-scanning alerts returned empty; pnpm audit reports 0 vulnerabilities. Latest main CI run 26416020351 on f47901c is green. Auto Release failures from 2026-05-24/25 are already covered by closed pm-yf8t and current main includes the build-before-pipeline fix. Active CI finding is recorded on child pm-7rlp: Nightly Validation run 26390994985 remains red only on Windows Node 20, with check-secrets/release-relevance SyntaxError, npm ENOENT in packed extension test, and generated runtime-loader drift. No duplicate pm item created.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:53:14.284Z"}],"before_hash":"b67f52a0ba62c49f5cf755294115cac3eb3a977d56f23d4454d49350c803a49b","after_hash":"e73aaee1f1eddb7a15cb12924d5275e6e34ed668cd35e95751c098bf5fc862c5"} | ||
| {"ts":"2026-05-25T19:53:42.800Z","author":"codex-sdk-calendar-review","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/285","value":{"created_at":"2026-05-25T19:53:42.800Z","author":"codex-sdk-calendar-review","text":"SDK/extensibility/calendar specialist review 2026-05-25: inspected dirty SDK/package/calendar contract changes plus package runtime helpers. Evidence: static no-extension calendar contract lookup fails with optional-package guidance as expected; isolated temp project with separate PM_PATH/PM_GLOBAL_PATH passed init -> install calendar --project -> contracts --action calendar --runtime-only --schema-only (actions=[calendar]) -> calendar agenda --format json. Focused verification passed: node scripts/run-tests.mjs test -- tests/unit/package-manifest.spec.ts tests/unit/sdk-index.spec.ts tests/unit/calendar-command.spec.ts (34 tests). Small test-maintainability fix made in tests/unit/package-manifest.spec.ts: bundled extension capability alignment now discovers packages/pm-*/extensions/* dynamically instead of hardcoding the current bundled package list."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:53:42.800Z"}],"before_hash":"e73aaee1f1eddb7a15cb12924d5275e6e34ed668cd35e95751c098bf5fc862c5","after_hash":"d7cca5cd77692d02a1bd062009c536b5f5d7bb2fa836d5bca86e33b98653921b"} | ||
| {"ts":"2026-05-25T19:56:39.113Z","author":"manual-dogfood-specialist","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/286","value":{"created_at":"2026-05-25T19:56:39.113Z","author":"manual-dogfood-specialist","text":"Manual dogfood/UX specialist evidence 2026-05-25: created isolated temp project /tmp/pm-cli-manual-dogfood-KBWbAV/launchops-agent-suite with PM_PATH and PM_GLOBAL_PATH isolated from the repo. Exercised init --defaults --with-packages, config context settings, schema add-type Experiment, create/update/claim/comments/notes/learnings/files/docs/tests/test-all, deps, context, list/search/activity/aggregate/stats/validate/health, calendar/cal, reindex keyword+semantic, search-advanced hybrid, plan create/add-step/complete/show, templates/guide/completion/governance package commands, package scaffold/install/doctor, local scaffold ping, npm:pm-changelog install and changelog generate --stdout. Positive results: runtime custom type worked; linked file/doc/test flows worked; linked test sandbox passed; calendar agenda surfaced deadline/reminder/event correctly; semantic reindex embedded stale item and hybrid ranked lop-ip1u duplicate calendar issue first; package doctor reported 10 active managed extensions after scaffold+changelog; final temp health ok.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:56:39.113Z"}],"before_hash":"d7cca5cd77692d02a1bd062009c536b5f5d7bb2fa836d5bca86e33b98653921b","after_hash":"ac68e124e326d6de11ade50095407e08b362c26adbcd152bc45368865c043416"} | ||
| {"ts":"2026-05-25T19:58:25.292Z","author":"codex-perf-search","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/287","value":{"created_at":"2026-05-25T19:58:25.292Z","author":"codex-perf-search","text":"Search/vector specialist evidence 2026-05-25: local Ollama is available with qwen3-embedding:0.6b. Isolated 80-item project showed mutation auto-indexing populated semantic artifacts during create; later reindex --mode hybrid --progress --json completed in 417ms with semantic unchanged_items=80, embedded_items=0, vector_upserted=0, batches_completed=0. Semantic search for OpenAI compatible LM Studio qwen embeddings completed in 920ms and returned semantic hits; hybrid search completed in 754ms and returned combined body/description/semantic/tags/title matches. Fresh 20-item project without installing search-advanced still auto-created search artifacts during mutation: create20 took 12656ms total (~633ms/item), install search-advanced 284ms, reindex cold 309ms but skipped unchanged_items=20, semantic search 593ms. PM_DISABLE_OLLAMA_AUTO_DEFAULTS=1 explicit semantic probe degraded to keyword mode with warning search_semantic_fallback:error:using_keyword_mode. Provider adapter inspection confirmed OpenAI-compatible endpoints normalize to /v1/embeddings and Ollama uses /api/embed with normalized response support for both OpenAI data[] and Ollama embeddings[]. Focused verification passed: PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/vector-store-adapter.spec.ts tests/unit/search-command.spec.ts tests/unit/reindex-command.spec.ts --reporter=dot (75 tests). No duplicate item created and no source edits made."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T19:58:25.292Z"}],"before_hash":"ac68e124e326d6de11ade50095407e08b362c26adbcd152bc45368865c043416","after_hash":"7e50da0a2969d0975f9c39c3262d8b25944488658a60fcfa8b7572c61a62287e","message":"Record search/vector semantic benchmark evidence"} | ||
| {"ts":"2026-05-25T20:02:29.028Z","author":"codex-full-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/288","value":{"created_at":"2026-05-25T20:02:29.028Z","author":"codex-full-audit","text":"Manual/temp-project verification 2026-05-25: local dist CLI walkthrough passed in isolated /tmp/pm-cli-manual-audit-O5RlrC with separate PM_PATH/PM_GLOBAL_PATH. Covered init --with-packages, config, schema shorthand (pm schema Experiment ...), create/update/claim/comments/notes/learnings/files/docs, plan create/show, deps/list/context/search/hybrid search, package install/list/doctor, calendar package agenda JSON, contracts create/files/runtime availability, history verify, linked test execution, validate, health, close, release, and comments --body recovery guidance. Read/query timings after setup in the small project: list-open 306ms, context 297ms, search 363ms, calendar 246ms. Also aligned files command contracts so root files no longer advertises discover-only --note/--apply flags."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:02:29.028Z"}],"before_hash":"7e50da0a2969d0975f9c39c3262d8b25944488658a60fcfa8b7572c61a62287e","after_hash":"544e797f5680aa93feddb7913d6437edd4d028aef78f40db3a0dd6531bfb1aa3"} | ||
| {"ts":"2026-05-25T20:08:30.977Z","author":"codex-code-quality-specialist","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/289","value":{"created_at":"2026-05-25T20:08:30.977Z","author":"codex-code-quality-specialist","text":"Code-quality/coverage/dead-code specialist pass 2026-05-25 reused existing lineage pm-rnpb/pm-7rlp/pm-3cbk; no duplicate item created. Current read-only findings: typecheck/static/docs/secret/full non-coverage tests pass; full coverage gate currently fails and is slow; jscpd found only 5 clone clusters, mostly generated, with two hand-maintained helper-extraction candidates; docs/skills gate passed and markdown duplicate percentage was 0 in jscpd; tests remain subprocess-heavy (313 runCli calls in cli.integration, 113 in release-readiness, 72 in help-runtime, only 4 runCliInProcess call sites). Recommended next implementation slice: fix vector-stores coverage, harden coverage reportsDirectory isolation, continue in-process migration for high-volume integration clusters, then extract the two duplicated helper patterns."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:08:30.977Z"}],"before_hash":"544e797f5680aa93feddb7913d6437edd4d028aef78f40db3a0dd6531bfb1aa3","after_hash":"a0bc98aef9dfc45a057037733c352030c290b45960fc70e66a8ec8b9ac208df9","message":"Specialist pass summary"} | ||
| {"ts":"2026-05-25T20:14:20.472Z","author":"codex-full-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/290","value":{"created_at":"2026-05-25T20:14:20.471Z","author":"codex-full-audit","text":"Final verification 2026-05-25: full release gate passed after LanceDB vector-store coverage fix. Command: node scripts/release/run-gates.mjs --telemetry-mode required --max-sentry-critical 10 --max-sentry-high 20 --max-telemetry-error-rate 10 --json. Results: build/typecheck/docs-skills/static-quality/coverage/version/security/npx smoke/package-first dogfood/npm pack/compatibility/Sentry+telemetry all ok; coverage 121 files / 1806 tests / 100% statements, branches, functions, lines; package-first dogfood 84 commands passed; Sentry critical=0 high=5 within threshold; telemetry finish_error_rate_pct=2.31 and failures_without_error_code_rows=0."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:14:20.472Z"}],"before_hash":"a0bc98aef9dfc45a057037733c352030c290b45960fc70e66a8ec8b9ac208df9","after_hash":"910ade26f689c42cf3711329801f4aa1da6d920087ce990999dbe31d1abe30cd"} | ||
| {"ts":"2026-05-25T20:14:25.902Z","author":"codex-full-audit","op":"release","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:14:25.902Z"}],"before_hash":"910ade26f689c42cf3711329801f4aa1da6d920087ce990999dbe31d1abe30cd","after_hash":"ab54da7d05df890606f38f1d13c083a7308bca9adde178d58033d675ed8c339b","message":"Release active audit claim after full gate"} | ||
| {"ts":"2026-05-25T20:18:13.022Z","author":"codex-full-manual-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:18:13.022Z"},{"op":"add","path":"/metadata/assignee","value":"codex-full-manual-audit"}],"before_hash":"ab54da7d05df890606f38f1d13c083a7308bca9adde178d58033d675ed8c339b","after_hash":"57676621e45307d1a2df3e64eeb4e93a185c73d7ab3fab4187bda509d79e5ef0","message":"Resume full manual audit with specialized sub-agent lanes"} | ||
| {"ts":"2026-05-25T20:19:31.911Z","author":"sdk-calendar-search-subagent","op":"note_add","patch":[{"op":"add","path":"/metadata/notes/2","value":{"created_at":"2026-05-25T20:19:31.911Z","author":"sdk-calendar-search-subagent","text":"Started SDK/package/calendar/search architecture review. Scope: current dirty checkout diffs in package.json, packages/pm-calendar, packages/pm-search-advanced, src/sdk/*, src/core/search/vector-stores.ts, and focused tests; no overlap with manual dogfood or CI performance lanes; reuse pm-rnpb parent and pm-59gj package lineage, with pm-gt82/pm-8nyc only if directly relevant."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:19:31.911Z"}],"before_hash":"57676621e45307d1a2df3e64eeb4e93a185c73d7ab3fab4187bda509d79e5ef0","after_hash":"b29bab7343b3733affa2350562aed368efd4c391c021fff2b5c3b2735e63540e"} | ||
| {"ts":"2026-05-25T20:19:38.726Z","author":"manual-dogfood-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/291","value":{"created_at":"2026-05-25T20:19:38.726Z","author":"manual-dogfood-subagent","text":"Manual dogfood subagent start 2026-05-25T20:20Z: isolated temp-project pass starting. Scope: init --with-packages, config/schema customization, lifecycle mutation/read commands, annotations, files/docs/tests, context/list/get/deps/aggregate/history/activity/validate/health/contracts, calendar package, package init/install/doctor/explore, semantic/hybrid search if embedding endpoint is available, and SDK import basics. No source edits intended."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:19:38.726Z"}],"before_hash":"b29bab7343b3733affa2350562aed368efd4c391c021fff2b5c3b2735e63540e","after_hash":"ba3d345a82727e46b3cbc3602a97531d8b3d415d25b49c9f8595b8e366967c3b"} | ||
| {"ts":"2026-05-25T20:19:59.307Z","author":"codex-full-manual-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/292","value":{"created_at":"2026-05-25T20:19:59.307Z","author":"codex-full-manual-audit","text":"Execution update 2026-05-25: resumed full manual audit from existing dirty checkout; reused pm-rnpb and pm-7rlp as canonical active items after pm context/search/list-open/list-in-progress and GitHub open issue/PR checks showed no duplicate broad item. Spawned specialist lanes for manual dogfood, SDK/package/calendar/search, CI/test quality, and GitHub/telemetry/Sentry/privacy. Local review found current changes are focused on command recovery, package contracts, calendar validation, Sentry usage-error handling, SDK runtime export, and LanceDB snapshot cache invalidation; adjusted the new permission-based vector-store test to skip on Windows because chmod-based EACCES is POSIX-specific."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:19:59.307Z"}],"before_hash":"ba3d345a82727e46b3cbc3602a97531d8b3d415d25b49c9f8595b8e366967c3b","after_hash":"9f55b97396eb87b90c90aad7d2fd41bfe6de3e53e4f3ae070c1ca5ec34c5a1d6"} | ||
| {"ts":"2026-05-25T20:20:07.042Z","author":"observability-security-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/293","value":{"created_at":"2026-05-25T20:20:07.042Z","author":"observability-security-subagent","text":"Observability/security sub-agent start 2026-05-25: ran required duplicate/context preflight (`pm context --json`, `pm search \"telemetry sentry github security privacy CI\" --json`, `pm list-open --json`, `pm list-in-progress --json`). Reusing pm-rnpb and CI child pm-7rlp; no duplicate tracker item created. Scope: GitHub PR/issue/check/dependency/security state, live telemetry/Sentry aggregate health, tracked privacy scan, redacted evidence only.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:20:07.042Z"}],"before_hash":"9f55b97396eb87b90c90aad7d2fd41bfe6de3e53e4f3ae070c1ca5ec34c5a1d6","after_hash":"d738486bff82ca5699e7cdb5c1a31067333b035d5724ebe8e549f87a5cd91c9e"} | ||
| {"ts":"2026-05-25T20:24:48.642Z","author":"sdk-calendar-search-subagent","op":"note_add","patch":[{"op":"add","path":"/metadata/notes/3","value":{"created_at":"2026-05-25T20:24:48.642Z","author":"sdk-calendar-search-subagent","text":"Final SDK/package/calendar/search lane evidence 2026-05-25: reviewed dirty diffs in package.json, packages/pm-calendar, packages/pm-search-advanced, src/sdk/*, src/core/search/vector-stores.ts, and focused related tests. No code changes made by this lane. Commands run: pm context/search/list-open/list-in-progress; pm package list --project; pm contracts runtime checks for calendar/reindex/completion; isolated PM_PATH/PM_GLOBAL_PATH init --defaults --with-packages + runtime contracts + calendar markdown smoke; focused pnpm tests for calendar/package-manifest/schema/sdk-index/vector-store plus completion/contracts. Results: all focused tests passed (73 + 109); temp package runtime smoke passed. Findings: no P0/P1 blocker in current dirty checkout for calendar/search SDK packaging; package-first/runtime boundary improvements are coherent. Carry forward under pm-59gj: completion rendering remains static/hardcoded instead of fully runtime/package-contract driven across bash/zsh/fish; semantic auto-defaults are intentionally Ollama/Qwen-local when no explicit settings exist, while explicit OpenAI-compatible/Ollama and extension provider paths remain model/provider neutral."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:24:48.642Z"}],"before_hash":"d738486bff82ca5699e7cdb5c1a31067333b035d5724ebe8e549f87a5cd91c9e","after_hash":"01368e22e1e3f0bb9c3d6fc13e427996b33ff5c3189698e8e7d570a69fc32b76"} | ||
| {"ts":"2026-05-25T20:24:54.934Z","author":"manual-dogfood-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/294","value":{"created_at":"2026-05-25T20:24:54.934Z","author":"manual-dogfood-subagent","text":"Manual dogfood subagent evidence 2026-05-25: isolated temp project /tmp/pm-cli-manual-subagent-BTiawR/launchops-agent-suite with PM_PATH=/tmp/pm-cli-manual-subagent-BTiawR/pm-data and PM_GLOBAL_PATH=/tmp/pm-cli-manual-subagent-BTiawR/pm-global. Used current built CLI dist/cli.js version 2026.5.24; no source edits. Covered init --defaults --with-packages, config read/set attempt, schema add-type Experiment, create/get/list/context/claim/update/comments/notes/learnings/files/docs/deps/aggregate/activity/history/contracts/validate/health/release/close, calendar agenda/week, keyword+hybrid search, reindex hybrid, package catalog/explore/doctor/init/install, runtime contracts, SDK import, linked tests/test-all. Final health ok=true, test-all passed 1 linked test, hybrid search ranked Experiment/Issue/Feature as expected, runtime contracts exposed 76 commands."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:24:54.934Z"}],"before_hash":"01368e22e1e3f0bb9c3d6fc13e427996b33ff5c3189698e8e7d570a69fc32b76","after_hash":"fee08d15e20fb9b383d9f32e66a7e647eca021b0c7ed372fec9cfa82e9cf5011"} | ||
| {"ts":"2026-05-25T20:28:14.925Z","author":"observability-security-subagent","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/295","value":{"created_at":"2026-05-25T20:28:14.925Z","author":"observability-security-subagent","text":"Observability/security evidence 2026-05-25: GitHub public repo state has 0 open PRs, 0 open issues, 0 open Dependabot alerts, and 0 open secret-scanning alerts. Latest main CI run 26416020351 succeeded for commit f47901c; code-scanning API returned no analysis / insufficient scope, so code-scanning state is inconclusive from current token. Reviewed historical failures: Auto Release 26387640606 failed on missing dist before current workflow build step; Nightly 26390994985 failed on Windows Node 20 test/npm/runtime-loader issues; CI 26397135725 failed in static changelog extension handling; Dependabot 26384310873 failed in upstream updater for an action update. Later main CI is green.\n\nSentry/telemetry: sentry issue list shows 5 unresolved high-priority pm-cli issues and 0 critical. Release gate `node scripts/release/sentry-telemetry-gate.mjs --json --telemetry-mode required --max-critical 10 --max-high 20 --max-telemetry-error-rate 10` passed with telemetry finish_error_rate_pct=2.31 and failures_without_error_code_rows=0. Remote stack health passed: containers up, API health ok, RabbitMQ queue depth 0 with 1 consumer, 22534 events in last 24h. Direct 7d telemetry query: 37084 finish events, 862 failures, 2.32% finish error rate; top failing commands were get, changelog generate, create, context, search, test, files, contracts, update, close. Local `pm health --check-only --check-telemetry --brief --json` warned because public endpoint probe returned HTTP 530 and local queue had 42 pending rows, despite remote stack health being ok.\n\nPrivacy: repo secret scan passed. Current tracked files and current tracked pm files contain no supplied private host, private stack path, or supplied password literal. `scripts/prod/telemetry/**` is ignored and has 0 tracked files. Git history still contains older private host/path references in historical commits; supplied password literal was not found in git history. Private aggregate report written under ignored scripts/prod/telemetry/reports/2026-05-25-observability-security-subagent.md.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:28:14.925Z"}],"before_hash":"fee08d15e20fb9b383d9f32e66a7e647eca021b0c7ed372fec9cfa82e9cf5011","after_hash":"74d3e6d2ba45d864b1ece5c3cf11b4accc51a1e7f73c8a15b297571885eeccd8"} | ||
| {"ts":"2026-05-25T20:29:20.920Z","author":"codex-full-manual-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/296","value":{"created_at":"2026-05-25T20:29:20.920Z","author":"codex-full-manual-audit","text":"Final roll-up 2026-05-25 full manual/sub-agent audit: reused existing active items pm-rnpb and pm-7rlp; no duplicate broad item created. Specialist lanes completed and documented evidence: manual dogfood passed in isolated temp project covering package bootstrap, custom schema, lifecycle, annotations, linked tests, calendar, search/reindex, package scaffold/install/doctor, SDK import, validate/health/release/close; SDK/package/calendar/search review found current dirty changes coherent and flagged shell completion package-runtime contract generation as a future pm-59gj follow-up; CI/code-quality review added a small test-helper input typing fix and confirmed the next speed win is migrating high-volume runCli clusters to runCliInProcess; observability/security review found no open PRs/issues/Dependabot/secret alerts, latest main CI green, tracked secret scan clean, Sentry 0 critical/5 high within maintained gate, telemetry 7d finish error rate about 2.32%, remote stack healthy, and scripts/prod/telemetry report kept ignored. Local verification after all lanes: pnpm build, pnpm typecheck, focused regression suite 125 tests, runner/stdin focused suite 16 tests, static quality, git diff --check, secret scan, changelog:pm:check unchanged, pm validate --check-resolution --check-history-drift ok, pm health --check-telemetry ok, and full release gate passed with 121 files / 1806 tests / 100% coverage plus package dogfood, npx smoke, npm pack, compatibility, and required Sentry/telemetry."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:29:20.920Z"}],"before_hash":"74d3e6d2ba45d864b1ece5c3cf11b4accc51a1e7f73c8a15b297571885eeccd8","after_hash":"b603677faac6b08da54c2fac6707076b4735a2fd5f0421298911570bbd9a56c4"} | ||
| {"ts":"2026-05-25T20:29:23.125Z","author":"codex-full-manual-audit","op":"release","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:29:23.125Z"}],"before_hash":"b603677faac6b08da54c2fac6707076b4735a2fd5f0421298911570bbd9a56c4","after_hash":"b38c75ec5a19f02390e65416859031e1ed9dad9a34770cc8c594587d626fb689","message":"Release full audit claim after validation"} | ||
| {"ts":"2026-05-25T20:35:05.003Z","author":"codex-active-continuation","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:35:05.003Z"},{"op":"add","path":"/metadata/assignee","value":"codex-active-continuation"}],"before_hash":"b38c75ec5a19f02390e65416859031e1ed9dad9a34770cc8c594587d626fb689","after_hash":"f0692b48c5dc2a3d77f3bdfcefac98e8c8a63cadd696f580387dea9c1e6293e1","message":"Continue active combined remediation PR with sub-agent lanes"} | ||
| {"ts":"2026-05-25T20:36:12.084Z","author":"codex-observability-scout","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/297","value":{"created_at":"2026-05-25T20:36:12.084Z","author":"codex-observability-scout","text":"Observability scout 2026-05-25T20:36Z (read-only aside from this comment):\n- Local pm health: `pm health --check-only --brief --check-telemetry --json` returned ok=true; telemetry enabled redacted mode, endpoint probe `https://pm-cli.unbrained.dev/healthz` status 200, queue_entries=2, queue_draining=true, last_successful_flush_at=2026-05-25T20:34:48.709Z, no failed flush.\n- Release gate: `node scripts/release/sentry-telemetry-gate.mjs --json --telemetry-mode required --max-critical 10 --max-high 20 --max-telemetry-error-rate 10 --max-telemetry-missing-error-rows 0` returned ok=true; Sentry critical=0 high=5 total=5, access_ok=true, threshold_ok=true; telemetry finish_error_rate_pct=2.36 and failures_without_error_code_rows=0.\n- Direct telemetry: `bash scripts/prod/telemetry/query-telemetry.sh --days 7 --limit 20` showed 37,333 finish events, 880 finish failures, 2.36% finish error rate, 0 missing error-code rows. Top failing commands: get 148, changelog generate 109, create 98, test/context/search 49 each.\n- Remote stack helper: `bash scripts/prod/telemetry/check-stack-health.sh` showed telemetry services up, API status ok version 2026.5.24, RabbitMQ queue `pm.telemetry.events` depth 0 with 1 consumer, and 22,950 Postgres events in the last 24h.\n- Sentry unresolved: `sentry issue list unbrained/pm-cli --query \"is:unresolved\" --period 14d --limit 50 --json` returned five unresolved high-priority groups: PM-CLI-Z calendar multiple positional views, PM-CLI-Y extension symlink EEXIST, PM-CLI-V ENOTEMPTY rmdir, PM-CLI-X extension mkdir EEXIST, PM-CLI-W copy self/subdirectory EINVAL.\n- Sentry recent: `sentry issue list unbrained/pm-cli --period 24h --limit 50 --json` returned only PM-CLI-Z. `sentry issue view PM-CLI-Z --json` showed count=1, firstSeen=lastSeen=2026-05-25T19:38:41.497Z, handled usage error from `pm-cli@2026.5.24`. `sentry log list unbrained/pm-cli --period 24h --limit 20 --json` returned recent warn-level `pm_cli_usage_error` logs, no error-level log burst in the sampled rows.\nActionable finding: PM-CLI-Z is fresh and should be triaged as calendar UX/telemetry noise reduction, but current observability gates and ingestion freshness are healthy. Blocker decision: no PR block from telemetry/Sentry unless the current PR directly changes calendar positional parsing or extension install/copy behavior.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:36:12.084Z"}],"before_hash":"f0692b48c5dc2a3d77f3bdfcefac98e8c8a63cadd696f580387dea9c1e6293e1","after_hash":"4ab85de8b32d6e44dabad9dbf7767799aae8cad12fcd14f5474ba04fa5757860","message":"Add redacted telemetry/Sentry scout evidence"} | ||
| {"ts":"2026-05-25T20:36:13.551Z","author":"codex-pm-changelog-scout","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/298","value":{"created_at":"2026-05-25T20:36:13.551Z","author":"codex-pm-changelog-scout","text":"pm-changelog/package-flow scout 2026-05-25:\n- npm latest: `npm view pm-changelog@latest version dist-tags --json` => latest 2026.5.24-15.\n- pm-cli installed project extension: `.agents/pm/extensions/pm-changelog/package.json`, manifest, and managed state all show 2026.5.24-15 from `npm:pm-changelog`.\n- `pm package doctor --project --detail deep --json` => ok=true, 1 active project extension, activation ok, no warnings/blocking failures.\n- `pm contracts --command 'changelog generate' --flags-only --json` exposes expected package command flags including --all-release-tags, --mode, --item-url-base, and --check.\n- pm-cli package-owned CHANGELOG flow: `node dist/cli.js changelog generate --output CHANGELOG.md --title \"Changelog\" --mode replace --all-release-tags --status closed --item-url-base https://github.com/unbraind/pm-cli/blob/main/.agents/pm --check --json` => unchanged, changed=false, item_count=837. No pm-cli blocker found.\n- Upstream repo `[redacted_path]/pm-changelog` is also at 2026.5.24-15 and clean, but its own `npm run changelog:check -- --json` exits 1 because generated output would date `2026.5.24-15` as 2026-05-25 while checked-in CHANGELOG.md has 2026-05-24. This is an upstream pm-changelog repo release/changelog freshness issue, not a pm-cli package-flow failure.\nRouting: do not block the pm-cli PR on this scout result. If strict upstream package release hygiene is in scope, fix/regenerate in `[redacted_path]/pm-changelog`; no pm-cli code change indicated.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:36:13.551Z"}],"before_hash":"4ab85de8b32d6e44dabad9dbf7767799aae8cad12fcd14f5474ba04fa5757860","after_hash":"14508e6a30c1e68c2927bdfc5e879f8b4cb86453e907d3f4ce86df434e51b373"} | ||
| {"ts":"2026-05-25T20:36:51.479Z","author":"github-dependency-security-scout","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/299","value":{"created_at":"2026-05-25T20:36:51.479Z","author":"github-dependency-security-scout","text":"GitHub/dependency/security scout evidence 2026-05-25 (read-only repo pass): gh auth status ok for unbraind with repo/workflow scopes; repo resolved as unbraind/pm-cli public main. gh issue list and gh pr list returned no open issues or PRs. Recent runs: latest main CI 26416020351 succeeded for f47901c; same-day cancelled CI 26415948706 was superseded by later green main CI. Security: gh dependabot alerts open returned []; full dependabot alerts list only fixed historical alerts. gh secret-scanning alerts returned []; repository vulnerability-alerts endpoint returned 204 enabled/accessible. Code scanning alerts could not be asserted clean because gh api returned no analysis found and requested admin:repo_hook scope. Package metadata: pnpm audit --json reported 0 low/moderate/high/critical vulnerabilities across 281 deps; pnpm outdated --format json returned {}; top-level installed versions include @sentry/node 10.53.1, commander 14.0.3, fast-glob 3.3.3, fast-json-patch 3.1.1, typebox 1.1.38, vitest 4.1.7, typescript 6.0.3. Dependency update signal: no npm package update or vulnerability action found; Dependabot github_actions updater had a historical upstream unknown_error for softprops/action-gh-release but no open PR/alert remained. Blocker assessment: no security/dependency finding should block the current PR; code scanning unavailable is a visibility limitation, not a confirmed blocker.\n"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:36:51.479Z"}],"before_hash":"14508e6a30c1e68c2927bdfc5e879f8b4cb86453e907d3f4ce86df434e51b373","after_hash":"1b5ea1dc7e5b0dae25f67ec2fdde6de38bf1a46de7aac851f18d91cd3ed4da77"} | ||
| {"ts":"2026-05-25T20:41:32.396Z","author":"codex-active-continuation","op":"history_redact","patch":[],"before_hash":"1b5ea1dc7e5b0dae25f67ec2fdde6de38bf1a46de7aac851f18d91cd3ed4da77","after_hash":"1b5ea1dc7e5b0dae25f67ec2fdde6de38bf1a46de7aac851f18d91cd3ed4da77","message":"Redact absolute local upstream repo path from changelog scout evidence"} | ||
| {"ts":"2026-05-25T20:46:41.834Z","author":"codex-active-continuation","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/300","value":{"created_at":"2026-05-25T20:46:41.834Z","author":"codex-active-continuation","text":"Continuation verification 2026-05-25: focused changed-surface tests passed (7 files / 125 tests); manual isolated temp-project walkthrough passed with separate PM_PATH/PM_GLOBAL_PATH after installing pm-changelog, covering init/package install, schema shorthand, lifecycle updates, annotations, linked test, list/context/search, calendar, changelog runtime contract, validate, health, close, and comments --body recovery suggesting --add. pm package doctor --project --detail deep passed with active pm-changelog 2026.5.24-15; pnpm changelog:pm:check reported CHANGELOG.md unchanged using package-owned flow. Full release gate passed after redacting an absolute local path from tracker evidence with pm history-redact: build/typecheck/docs/static/coverage/version/security/npx smoke/package-first dogfood/npm pack/compatibility/Sentry+telemetry all ok; coverage 121 files / 1806 tests / 100%; Sentry critical=0 high=5 within threshold; telemetry finish_error_rate_pct=2.37 and missing error-code rows=0. Upstream pm-changelog date-context bug was fixed separately in the pm-changelog repo by a worker and does not block this pm-cli PR."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-25T20:46:41.834Z"}],"before_hash":"1b5ea1dc7e5b0dae25f67ec2fdde6de38bf1a46de7aac851f18d91cd3ed4da77","after_hash":"2574d88f60a561f384c7d68361da78739d570e80a087f875020952fc31df84b9","message":"Record final verification for combined active remediation"} |
There was a problem hiding this comment.
Do not modify .agents/pm history files directly in this PR.
This file is under the protected system-of-record path and should be updated only through the pm workflow/tooling, not by direct file edits in code changes.
As per coding guidelines, .agents/pm/**: pm is the system of record. Do not edit .agents/pm files directly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/pm/history/pm-rnpb.jsonl around lines 631 - 658, The change directly
edited system-of-record history entries (JSON ops like "comment_add", "claim",
"release" touching metadata.comments, metadata.assignee and metadata/updated_at)
which must not be modified by hand; revert these direct edits and remove this
file from the PR, then reapply any intended audit/metadata updates using the
official pm workflow/tooling (e.g., the pm history/pm CLI commands or the repo's
pm-agent APIs) so the entries are recorded via the supported "pm" processes
rather than manual JSON edits.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6adee884b6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| { flag: "--list" }, | ||
| { flag: "--apply" }, | ||
| { flag: "--note" }, | ||
| { flag: "--append-stable" }, | ||
| { flag: "--validate-paths" }, |
There was a problem hiding this comment.
files discover still accepts --apply and --note (see register-mutation.ts), but those flags were removed from FILES_FLAG_CONTRACTS. This contract feeds both bootstrap flag recovery (resolveSubcommandFlagContractsForCommand) and pm contracts --command files --flags-only, so valid discover flags are now omitted from the published surface and typo/alias normalization for that subcommand regresses.
Useful? React with 👍 / 👎.
| "aggregate", | ||
| "dedupe-audit", | ||
| "guide", | ||
| "context", | ||
| "ctx", | ||
| "get", | ||
| "search", |
There was a problem hiding this comment.
Removing package-owned entries from PM_CORE_COMMAND_NAMES breaks top-level shell completion suggestions because completion generation builds its command list directly from this constant (ALL_COMMANDS in src/cli/commands/completion.ts). After installing package commands like guide, completion, reindex, normalize, comments-audit, or test-runs, the generated completion scripts stop suggesting those available commands at the first token.
Useful? React with 👍 / 👎.
| default: | ||
| return withSubcommandGlobalFlags([]); |
There was a problem hiding this comment.
The switch now falls back to [] for package-owned commands such as guide, completion, normalize, dedupe-audit, and test-runs because their cases were removed. resolveSubcommandFlagContractsForCommand is used by bootstrap flag normalization and unknown-option recovery, so installed package commands lose their expected canonical flag mapping/suggestions and degrade CLI recovery behavior.
Useful? React with 👍 / 👎.
Preserve extension exit-code semantics for non-Error throws and avoid mapping invalid numeric exit codes to success. Also document PR #71 review follow-up in pm-rnpb. Verification: - PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/cli-main-errors.spec.ts tests/unit/sentry-helpers.spec.ts tests/integration/help-runtime.spec.ts tests/unit/calendar-command.spec.ts --reporter=dot - pnpm typecheck - pnpm quality:static - node scripts/check-secrets.mjs - pm validate --check-resolution --check-history-drift --json
|
@codex review Follow-up pushed in 8c63dfc. I addressed the valid exit-code/Sentry feedback in src/cli/main.ts and added tests/unit/cli-main-errors.spec.ts. CodeRabbit's tracker-file comments were reviewed as false positives: the .agents/pm changes were generated through pm CLI commands, including pm history-redact with hash-chain verification. |
There was a problem hiding this comment.
Code Review
This pull request introduces several robustness and extensibility improvements across the CLI, SDK, and bundled packages. Key changes include removing optional package-owned commands from the core SDK enums, exporting ./sdk/runtime publicly, adding semantic recovery suggestions for common CLI typos/mistakes, and implementing cache invalidation for LanceDB local snapshots when modified externally. The review feedback highlights three valuable improvement opportunities: making the schema shorthand check more robust against single-string aliases, simplifying the dedupeStrings helper using a native Set, and hardening the package manifest test's regex-based JSON parsing against trailing commas.
| const usedAddTypeOption = | ||
| typeof options.description === "string" || | ||
| typeof defaultStatus === "string" || | ||
| typeof options.folder === "string" || | ||
| (aliases?.length ?? 0) > 0; |
There was a problem hiding this comment.
In usedAddTypeOption, the check for aliases length ((aliases?.length ?? 0) > 0) assumes that aliases is always an array. However, if options.alias is a string (which happens when a single alias is provided and not coerced to an array), aliases will be undefined because of the Array.isArray check on line 765. This means usedAddTypeOption will evaluate to false if only --alias is provided, causing the shorthand command parsing to fail with an "Unknown pm schema subcommand" error.
To make this check more robust and prevent potential parsing failures, we should directly check if options.alias is defined.
| const usedAddTypeOption = | |
| typeof options.description === "string" || | |
| typeof defaultStatus === "string" || | |
| typeof options.folder === "string" || | |
| (aliases?.length ?? 0) > 0; | |
| const usedAddTypeOption = | |
| typeof options.description === "string" || | |
| typeof defaultStatus === "string" || | |
| typeof options.folder === "string" || | |
| options.alias !== undefined; |
| function dedupeStrings(values: string[]): string[] { | ||
| const seen = new Set<string>(); | ||
| const result: string[] = []; | ||
| for (const value of values) { | ||
| if (seen.has(value)) { | ||
| continue; | ||
| } | ||
| seen.add(value); | ||
| result.push(value); | ||
| } | ||
| return result; | ||
| } |
There was a problem hiding this comment.
The helper function dedupeStrings can be simplified by leveraging the native ES6 Set and spread operator [...new Set(values)], which is already the established pattern in this file (e.g., on lines 267 and 270). This simplifies the codebase and improves maintainability.
function dedupeStrings(values: string[]): string[] {
return [...new Set(values)];
}| const capabilitiesMatch = source.match(/capabilities:\s*(\[[^\]]*\])/); | ||
| expect(capabilitiesMatch?.[1], modulePath).toBeDefined(); | ||
| const moduleCapabilities = JSON.parse(capabilitiesMatch?.[1]?.replace(/'/g, "\"") ?? "[]") as unknown; | ||
| expect(moduleCapabilities, modulePath).toEqual(manifest.capabilities); |
There was a problem hiding this comment.
Using JSON.parse on a regex-extracted JavaScript array string is fragile because standard JSON does not allow trailing commas (e.g., ["commands", "schema",]), which are common in JavaScript/TypeScript codebases and style guides (like Prettier). If a developer adds a trailing comma to the capabilities array in index.js, this test will throw a SyntaxError and fail.
To make the test more robust, we can strip any trailing commas before parsing the JSON.
const capabilitiesMatch = source.match(/capabilities:\s*(\[[^\]]*\])/);
expect(capabilitiesMatch?.[1], modulePath).toBeDefined();
const cleanedCapabilities = capabilitiesMatch?.[1]
?.replace(/'/g, '"')
?.replace(/,\s*\]/, "]");
const moduleCapabilities = JSON.parse(cleanedCapabilities ?? "[]") as unknown;
expect(moduleCapabilities, modulePath).toEqual(manifest.capabilities);
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8c63dfc570
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const expectedExitCodes: ReadonlySet<number> = new Set([ | ||
| EXIT_CODE.SUCCESS, | ||
| EXIT_CODE.USAGE, |
There was a problem hiding this comment.
exitCode=0 failures
shouldCaptureCliError currently treats EXIT_CODE.SUCCESS as an expected, non-reportable thrown error code, but runPmCli normalizes thrown exitCode <= 0 to a failing exit code. In the concrete case where an extension throws an Error with exitCode: 0, the CLI exits as failure while Sentry exception capture is skipped, which hides real extension/runtime defects from error triage. Please remove success from the expected thrown-error set (or normalize before filtering) so these failures are captured.
Useful? React with 👍 / 👎.
| const snapshotPath = getLanceDbSnapshotPath(lanceDbStore.path, upsertBody.table); | ||
| const snapshotStats = await stat(snapshotPath); |
There was a problem hiding this comment.
After writing local LanceDB snapshots, executeVectorUpsert immediately re-stats the file without handling ENOENT. In concurrent CLI runs, another process can delete/replace the snapshot between persistLanceDbLocalTable and this stat, causing the mutation to throw even though the upsert already succeeded. This introduces false failures for multi-process usage; treat post-write stat races as cache invalidation instead of hard errors (and apply the same guard in executeVectorDelete).
Useful? React with 👍 / 👎.
| typeName === undefined && | ||
| usedAddTypeOption | ||
| ) { | ||
| typeName = subcommand; | ||
| normalizedSubcommand = "add-type"; |
There was a problem hiding this comment.
The new shorthand path converts any unknown schema subcommand into add-type whenever add-type-style flags are present and no second positional argument is provided. That means a typo like pm schema add-typ --description "..." silently creates a custom type named add-typ instead of failing fast with an unknown-subcommand usage error, which can mutate schema state unintentionally and is hard to detect in automation.
Useful? React with 👍 / 👎.
Regenerate CHANGELOG.md through the package-owned pm-changelog flow after CI installed pm-changelog@2026.5.25 and detected drift. Keep the project-managed pm-changelog extension cache aligned with the latest package, simplify command suggestion dedupe, harden schema alias normalization, and make package capability parsing tolerate trailing commas. Document the follow-up on pm-rnpb. Verification: focused Vitest suite (6 files/90 tests); pnpm typecheck; pnpm quality:static; pnpm changelog:pm:check; node scripts/check-secrets.mjs; pm validate --check-resolution --check-history-drift --json; git diff --check.
|
@codex review Follow-up pushed in b8a7460. Fixed CI changelog drift with the package-owned pm-changelog flow after pm-changelog@2026.5.25 installed in CI, aligned the project-managed extension cache, and addressed the valid fresh Gemini nits around dedupe, schema alias normalization, and capability parsing. Verification passed locally: focused Vitest suite, typecheck, static gate, changelog:pm:check, secret scan, pm validate, and git diff --check. |
There was a problem hiding this comment.
Code Review
This pull request introduces several enhancements to the SDK package boundaries, command recovery UX, and local vector store caching. Key changes include publishing the ./sdk/runtime subpath, removing optional package-owned commands from core SDK enums, adding command alias suggestions (e.g., show to get) and semantic option recovery (e.g., suggesting --add for --body), and reloading LanceDB local snapshots when the backing file is modified or deleted. Feedback focuses on aligning the keys in SEMANTIC_UNKNOWN_OPTION_SUGGESTIONS with the output of normalizeLongFlag to prevent lookup failures, and optimizing the LanceDB cache loader to reuse empty cached records and avoid redundant map allocations when the snapshot file is missing.
| const SEMANTIC_UNKNOWN_OPTION_SUGGESTIONS: Record<string, Record<string, string[]>> = { | ||
| comments: { | ||
| "--body": ["--add"], | ||
| "--text": ["--add"], | ||
| "--comment": ["--add"], | ||
| }, | ||
| notes: { | ||
| "--body": ["--add"], | ||
| "--text": ["--add"], | ||
| "--note": ["--add"], | ||
| }, | ||
| learnings: { | ||
| "--body": ["--add"], | ||
| "--text": ["--add"], | ||
| "--learning": ["--add"], | ||
| }, | ||
| }; |
There was a problem hiding this comment.
The keys in SEMANTIC_UNKNOWN_OPTION_SUGGESTIONS use leading dashes (e.g., "--body"), but normalizeLongFlag may return the normalized flag name without dashes. If there is a mismatch, the lookup on line 347 will silently fail and suggestions will not be displayed. Align the keys to match the output of normalizeLongFlag.
| if (cached && !snapshotStats) { | ||
| const loaded = new Map<string, VectorRecord>(); | ||
| lanceDbLocalTables.set(key, { records: loaded, mtimeMs: null, size: null }); | ||
| return loaded; | ||
| } |
There was a problem hiding this comment.
When the snapshot file is missing (snapshotStats is null) and the cache already represents a missing file (cached.mtimeMs === null), a new Map is allocated and the cache is overwritten on every invocation. Reusing the existing cached empty records when cached.mtimeMs === null avoids redundant allocations.
if (cached && !snapshotStats) {
if (cached.mtimeMs === null) {
return cached.records;
}
const loaded = new Map<string, VectorRecord>();
lanceDbLocalTables.set(key, { records: loaded, mtimeMs: null, size: null });
return loaded;
}
|
Codex Review: Didn't find any major issues. Chef's kiss. ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
Normalize semantic unknown-option suggestion keys during lookup so future key formatting cannot break recovery suggestions. Reuse an already-empty LanceDB local snapshot cache entry when the backing file is still missing, avoiding redundant empty map allocation on repeated loads. Document the review follow-up on pm-rnpb. Verification: focused Vitest help-runtime/vector-store suite (61 tests); pnpm typecheck; pnpm quality:static; node scripts/check-secrets.mjs; pm validate --check-resolution --check-history-drift --json; git diff --check.
|
@codex review Follow-up pushed in 9fda759. Addressed latest Gemini feedback: semantic unknown-option suggestion lookup now normalizes configured keys at comparison time, and LanceDB local cache reuses an already-empty missing-snapshot cache entry. Verification passed locally: focused help/vector-store Vitest suite, typecheck, static gate, secret scan, pm validate, and git diff --check. |
There was a problem hiding this comment.
Code Review
This pull request refactors the CLI and SDK architecture to enforce package boundaries, improve command recovery, and optimize local vector store caching. Key changes include removing optional package-owned commands from core SDK enums, publicly exporting ./sdk/runtime, introducing telemetry-informed command aliases and semantic option suggestions, and implementing local snapshot cache invalidation in LanceDB based on file stats. Additionally, Sentry error capturing has been refined to ignore standard CLI usage, not-found, and conflict exit codes. Feedback on the changes highlights a potential TOCTOU race condition in src/core/search/vector-stores.ts where the cache could store stale stats if readFile fails with ENOENT after stat succeeds, suggesting resetting snapshotStats to null in the catch block.
| throw error; | ||
| } | ||
| } | ||
| lanceDbLocalTables.set(key, loaded); | ||
| lanceDbLocalTables.set(key, { | ||
| records: loaded, | ||
| mtimeMs: snapshotStats?.mtimeMs ?? null, | ||
| size: snapshotStats?.size ?? null, | ||
| }); |
There was a problem hiding this comment.
If readFile fails with ENOENT after stat has succeeded (a TOCTOU race condition), the cache will store the non-null mtimeMs and size of the deleted file alongside an empty map. Resetting snapshotStats to null in the ENOENT catch block ensures the cache correctly reflects that the file is missing.
| throw error; | |
| } | |
| } | |
| lanceDbLocalTables.set(key, loaded); | |
| lanceDbLocalTables.set(key, { | |
| records: loaded, | |
| mtimeMs: snapshotStats?.mtimeMs ?? null, | |
| size: snapshotStats?.size ?? null, | |
| }); | |
| throw error; | |
| } | |
| snapshotStats = null; | |
| } | |
| lanceDbLocalTables.set(key, { | |
| records: loaded, | |
| mtimeMs: snapshotStats?.mtimeMs ?? null, | |
| size: snapshotStats?.size ?? null, | |
| }); |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
Add a regression assertion for querying a deleted LanceDB local snapshot twice so the optimized empty-cache reuse branch remains covered under the 100% coverage gate. Document the CI coverage follow-up on pm-rnpb. Verification: focused Vitest help-runtime/vector-store suite (61 tests); pnpm typecheck; pnpm quality:static; node scripts/check-secrets.mjs; pm validate --check-resolution --check-history-drift --json; git diff --check.
|
@codex review Coverage follow-up pushed in b7e668c. GitHub coverage showed the new LanceDB repeated-missing-snapshot fast path was uncovered, so I added a regression assertion that queries a deleted local snapshot twice. Verification passed locally: focused help/vector-store Vitest suite, typecheck, static gate, secret scan, pm validate, and git diff --check. |
There was a problem hiding this comment.
Code Review
This pull request introduces several correctness, extensibility, and UX improvements across the CLI, SDK, and bundled packages. Key changes include publishing the ./sdk/runtime subpath in package.json exports, aligning extension module manifests with manifest.json capabilities, and removing optional package-owned commands from core SDK static resolvers. Additionally, the CLI's error recovery is enhanced with telemetry-informed unknown command aliases (e.g., show to get) and semantic option suggestions (e.g., suggesting --add when --body is used on append-style commands). The LanceDB local snapshot cache was also optimized to detect and reload when backing files are deleted or modified by external processes, and the calendar package now validates output formats and positional views with proper exit codes. Since there are no review comments, no feedback is provided.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7e668ca29
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| for (const key of Object.keys(env)) { | ||
| if (env[key] !== process.env[key]) { | ||
| keys.add(key); | ||
| } | ||
| } |
There was a problem hiding this comment.
Avoid filtering keys to only entries whose values differ before the run: this drops restoration for env vars that start with the same value but are mutated during CLI execution. The in-process CLI path does mutate inherited vars (for example applyBootstrapPagerPolicy sets PAGER/MANPAGER/GIT_PAGER in src/cli/bootstrap-args.ts), so when those vars are already present in the parent environment they now leak as cat into later tests, causing cross-test state pollution and environment-dependent flakes.
Useful? React with 👍 / 👎.
Summary
show,comment, append-style--body/--textflags)pm-rnpb,pm-7rlp,pm-8nyc,pm-59gj,pm-gt82, andpm-3cbkVerification
PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/integration/help-runtime.spec.ts tests/unit/calendar-command.spec.ts tests/unit/package-manifest.spec.ts tests/unit/schema-command.spec.ts tests/unit/sdk-index.spec.ts tests/unit/sentry-helpers.spec.ts tests/unit/vector-store-adapter.spec.ts --reporter=dotPM_PATHandPM_GLOBAL_PATHpm package doctor --project --detail deep --jsonpnpm changelog:pm:checknode scripts/check-secrets.mjspm validate --check-resolution --check-history-drift --jsonnode scripts/release/run-gates.mjs --telemetry-mode required --max-sentry-critical 10 --max-sentry-high 20 --max-telemetry-error-rate 10 --jsonNotes
pm-changelog@2026.5.24-15remains the latest published package and thepm-clipackage-owned changelog check is clean. A separate upstreampm-changelogdate-context bug was fixed in the package repo and should ship through that repo's own PR/publish flow.pm history-redact; the history chain revalidated cleanly.