Add repo wiki advisory context packets#474
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 34 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds optional repo-wiki advisory context from a prepared PR worktree, wires it through review-mode gating and worker execution, and renders it as untrusted prompt content with path, freshness, budget, and redaction controls. ChangesRepoWikiContext feature
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
evaOS review status: stale headPR: #474 - Add repo wiki advisory context packets evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #474 |
evaOS review status: stale headPR: #474 - Add repo wiki advisory context packets evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Details: live=65796726668474d334c53b38e592e1115e2a426c |
5886dc8 to
6579672
Compare
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: 65796726668474d334c53b38e592e1115e2a426c into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +17/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +14/-8 | Documentation | Low |
src/config.ts |
modified | +23/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +257/-0 | Runtime code | Moderate: validated P3 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +33/-0 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +15/-0 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +229/-0 | Test coverage | Elevated: large change |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 1 (P0: 0, P1: 0, P2: 0, P3: 1).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Runtime correctness: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: ada4e1d5b3a806b5b19694e83be005be5f681402 into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +17/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +14/-8 | Documentation | Low |
src/config.ts |
modified | +23/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +257/-0 | Runtime code | Moderate: validated P2 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +33/-0 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +15/-0 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +250/-0 | Test coverage | Moderate: validated P3 finding |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 3 (P0: 0, P1: 0, P2: 1, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Security boundary: 3
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: eb39352b915ecc5bc53bf62de5a98f109e490113 into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +17/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +14/-8 | Documentation | Low |
src/config.ts |
modified | +23/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +262/-0 | Runtime code | Elevated: large change |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: validated P3 finding |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +33/-0 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +15/-0 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +290/-0 | Test coverage | Elevated: large change |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 1 (P0: 0, P1: 0, P2: 0, P3: 1).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Runtime correctness: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: f3ed50ed5b5aafbd76b85d64081a6ad14fa0efeb into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +17/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +14/-8 | Documentation | Low |
src/config.ts |
modified | +23/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +262/-0 | Runtime code | Moderate: validated P2 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +63/-13 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +15/-0 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +312/-0 | Test coverage | Elevated: large change |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 3 (P0: 0, P1: 0, P2: 1, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Proof gap: 1
- Runtime correctness: 1
- Security boundary: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
|
@evaos-code-review-bot review |
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
|
evaOS Code Review Bot queued a current-head review for Command: Safety boundary: command handling cannot approve, merge, repair, push branches, or expand repo permissions. |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: 83a8254be358a2b430a5338b0f44814ee040b491 into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +18/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +21/-8 | Documentation | Low |
src/config.ts |
modified | +23/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +264/-0 | Runtime code | Moderate: validated P3 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +63/-13 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +16/-0 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +380/-0 | Test coverage | Elevated: large change |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 2 (P0: 0, P1: 0, P2: 0, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Runtime correctness: 1
- Security boundary: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: 99ca85c6453e10b66de47eb1bfaec4deea9d48f1 into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +19/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +23/-8 | Documentation | Low |
src/config.ts |
modified | +25/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +305/-0 | Runtime code | Moderate: validated P2 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +63/-13 | Runtime code | Moderate: validated P3 finding |
src/zcode.ts |
modified | +16/-0 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +416/-0 | Test coverage | Moderate: validated P3 finding |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 4 (P0: 0, P1: 0, P2: 1, P3: 3).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Proof gap: 1
- Runtime correctness: 2
- Security boundary: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/repo-wiki-context.ts (1)
103-134: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winRestore the pre-read size gate
readFileSync(sourcePath, "utf8")still unconditionally pulls the entire PR-controlled packet into memory beforebudget_exceededcan fire. A maliciously large.neondiff/repo-wiki-packet.jsoncan force a full read/UTF-8 decode first, which is the memory-exhaustion path this guard is supposed to block. Check file metadata up front (statSync) and reject oversized packets beforereadFileSync/decode/parse. Confidence: 85%.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/repo-wiki-context.ts` around lines 103 - 134, The repo wiki packet handling in the context loader still reads the full file before the size check, so restore the pre-read guard in the packet-loading flow around the readFileSync/sourcePath logic. Use file metadata first (for example via statSync) to compare the packet size against maxPacketBytes plus PACKET_FILE_OVERHEAD_BYTES, and return the budget_exceeded omitted result before any UTF-8 decode or parse happens. Keep the existing omitted reasons and evidenceSourcePath behavior in the same packet-loading path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/repo-wiki-context.ts`:
- Around line 103-134: The repo wiki packet handling in the context loader still
reads the full file before the size check, so restore the pre-read guard in the
packet-loading flow around the readFileSync/sourcePath logic. Use file metadata
first (for example via statSync) to compare the packet size against
maxPacketBytes plus PACKET_FILE_OVERHEAD_BYTES, and return the budget_exceeded
omitted result before any UTF-8 decode or parse happens. Keep the existing
omitted reasons and evidenceSourcePath behavior in the same packet-loading path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fd45a248-755a-44e8-86a7-dec97ee0107d
📒 Files selected for processing (8)
config.example.jsondocs/neondiff-config.mdsrc/config.tssrc/repo-wiki-context.tssrc/worker.tssrc/zcode.tstests/repo-wiki-context.test.tstests/zcode-output.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Build, test, and package
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
🪛 ast-grep (0.44.1)
src/zcode.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawnSync } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawnSync } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawnSync } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { spawnSync } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔇 Additional comments (13)
src/worker.ts (3)
56-61: Diff content doesn't match PR objectives/line_range_change_details.Every PR-level artifact (objectives, commit summary,
line_range_change_details) describes this cohort asrepoWikiContextreview-mode gating and worker wiring. The actual~-marked diff in this file is entirely about a newbuildReviewLensContext/review-lens feature — norepoWikiContextlines are marked as changed (they're shown only as unchanged context, already fixed per the prior review thread). Reviewing on the assumption the described repoWikiContext gating is what's under test here would be reviewing against the wrong code.Also applies to: 1493-1498, 1525-1525, 2390-2419
1493-1498: Wiring itself is fine.Call site and prompt-spread follow the established optional-packet pattern (
packet ? {...} : {}). No issues beyond the throw behavior flagged separately above.Also applies to: 1525-1525
2404-2407: 🩺 Stability & AvailabilityPotential hard-fail in
buildReviewLensContext. If thisthrowis reachable, one redaction failure will rejectreviewPulland block the entire PR review instead of degrading to{}like the other optional context builders. Please confirm the intended failure mode. Confidence: 52%.src/zcode.ts (3)
195-259: LGTM! All other advisory-packet builders (skill-pack, GitHub-related, GitNexus, repo-wiki, repo-memory) consistently route throughbuildAdvisoryContextPromptSection/quoteAdvisoryMarkdown, correctly closing the injection surface previously flagged and confirmed fixed.
9-17: LGTM! Import addition, extendedbuildReviewPromptinput typing (includingrepoWikiContextPacket/reviewLensPacket), and conditional prompt-section inclusion are consistent with the rest of the assembly pipeline.Also applies to: 124-136, 148-176
18-21: 🔒 Security & PrivacyReviewLens markdown should use the shared advisory renderer.
buildReviewLensPromptSectionstill appendspacket.markdown.trim()directly, unlike the other advisory packet paths that go throughbuildAdvisoryContextPromptSection/quoteAdvisoryMarkdown. IfReviewLensPacketcontent is untrusted, this leaves the same prompt-injection surface open and should be routed through the shared quoting path.tests/repo-wiki-context.test.ts (1)
264-282: LGTM!Also applies to: 359-424
tests/zcode-output.test.ts (1)
2-3: LGTM!Also applies to: 40-65, 67-101
config.example.json (1)
60-66: LGTM!docs/neondiff-config.md (1)
311-329: LGTM!src/config.ts (1)
82-82: LGTM!Also applies to: 657-659, 929-929, 994-1005
src/repo-wiki-context.ts (2)
136-196: LGTM on the previously-flagged hardening — all confirmed still in place except the read-before-size-check regression noted separately.Freshness-before-budget ordering (166-184), raw+rendered secret scanning (136, 155), hash recomputed from markdown rather than trusted from packet fields (339), and headSha-gated "fresh" claims (334-335) all match the fixes recorded in this file's review history and show no regression here.
Also applies to: 236-269, 316-351
364-370: 🎯 Functional Correctness | ⚡ Quick winType-guard accepts a
source.statusvalue the target type doesn't declare.
readFreshness(line 432) treats"unknown"as a valid return value, sovalidateRepoWikiPacketShape(line 370) acceptssource.status: "unknown"from PR-authored JSON, andisRepoWikiPacketShape(line 391-393) then asserts the parsed objectis RepoWikiPacket. ButRepoWikiSourceStatus(src/repo-wiki-packet.ts) is declared as"fresh" | "stale" | "missing"only —"unknown"isn't a member.Impact today is contained:
packetFromRepoWikiPacketre-derives freshness viareadFreshness(safePacket.source.status) ?? "unknown", so runtime behavior is correct regardless. But the type guard is unsound — any future code that exhaustively switches onRepoWikiPacket["source"]["status"](3 cases) assuming TypeScript's guarantee will silently mishandle an actual"unknown"value, since the compiler thinks that branch is unreachable. Confidence: 70% — this is a static-typing soundness gap, not a demonstrated runtime bug, and I don't have visibility into every downstream consumer ofRepoWikiPacket.source.status.Fix: either narrow
validateRepoWikiPacketShape's status check to only acceptfresh|stale|missing(rejecting"unknown"packets asinvalid_packet), or widenRepoWikiSourceStatusto include"unknown"so the type accurately reflects what the guard allows through.🔧 Proposed fix: reject "unknown" at the shape-validation boundary
- if (!readFreshness(input.source.status)) return "source.status must be fresh, stale, missing, or unknown"; + const rawStatus = input.source.status; + if (rawStatus !== "fresh" && rawStatus !== "stale" && rawStatus !== "missing") { + return "source.status must be fresh, stale, or missing"; + }Also applies to: 391-393, 432-434
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: 30124dee7f47bb6755d7330763e1e69933632cec into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +20/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +26/-8 | Documentation | Low |
src/config.ts |
modified | +25/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +442/-0 | Runtime code | Moderate: validated P3 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +69/-15 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +55/-27 | Runtime code | Moderate: validated P3 finding |
tests/repo-wiki-context.test.ts |
added | +554/-0 | Test coverage | Elevated: large change |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
tests/zcode-output.test.ts |
modified | +63/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 3 (P0: 0, P1: 0, P2: 0, P3: 3).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Runtime correctness: 1
- Security boundary: 2
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: 18615bd371f4ebd4ac580249dfbd964d9aa33d2b into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +20/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +26/-8 | Documentation | Low |
src/config.ts |
modified | +25/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +451/-0 | Runtime code | Moderate: validated P2 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +69/-15 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +63/-36 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +573/-0 | Test coverage | Elevated: large change |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
tests/zcode-output.test.ts |
modified | +64/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 1 (P0: 0, P1: 0, P2: 1, P3: 0).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Security boundary: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
evaOS review status: stale headPR: #474 - Add repo wiki advisory context packets evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Details: live=e9a93109568bf5b9c0ff3f470b183b204d9b294d |
evaOS review status: completedPR: #474 - Add repo wiki advisory context packets evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #474 Review URL: #474 (review) |
|
@coderabbitai review CodeRabbit status is still pending on |
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Walkthrough
PR: #474 - Add repo wiki advisory context packets
Head: e9a93109568bf5b9c0ff3f470b183b204d9b294d into main. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~70 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
config.example.json |
modified | +7/-0 | Configuration | Low |
docs/neondiff-config.md |
modified | +20/-0 | Documentation | Low |
docs/repo-wiki-packet.md |
modified | +26/-8 | Documentation | Low |
src/config.ts |
modified | +25/-1 | Configuration | Moderate: runtime path |
src/repo-wiki-context.ts |
added | +503/-0 | Runtime code | Moderate: validated P3 finding |
src/review-mode-router.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/review-mode-types.ts |
modified | +2/-0 | Runtime code | Moderate: runtime path |
src/worker.ts |
modified | +69/-15 | Runtime code | Moderate: runtime path |
src/zcode.ts |
modified | +63/-36 | Runtime code | Moderate: runtime path |
tests/repo-wiki-context.test.ts |
added | +594/-0 | Test coverage | Moderate: validated P3 finding |
tests/review-mode-router.test.ts |
modified | +7/-1 | Test coverage | Low |
tests/zcode-output.test.ts |
modified | +64/-1 | Test coverage | Low |
Review Signal
Validated inline findings: 2 (P0: 0, P1: 0, P2: 0, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Proof gap: 1
- Security boundary: 1
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
Proof status: sufficient - PR metadata mentions acceptable proof for each required validation recommendation.
Profile validation hints: Current-head, App-authored, no-secret, no-duplicate, and no-repo-mutation invariants outrank style feedback.
Profile proof expectations: Require focused tests, TypeScript build, App-backed doctor, release-status proof, and launchd heartbeat before live promotion.
Related Context
Related issues/PRs: #415, #230.
Suggested labels: docs, tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
src/github.ts- Treat GitHub App identity or token-mode regressions as high risk. - Path instructions:
src/state.ts- Check duplicate suppression, leases, processed heads, and migration safety. - Path instructions:
src/worker.ts- Check stale-head guards, repo mutation protection, and review posting policy. - Path instructions:
src/zcode.ts- Check read-only ZCode policy, prompt constraints, and output parsing. - Label suggestions: bot, regression-hardening, release
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: closed or merged before reviewPR: #474 - Add repo wiki advisory context packets evaOS review stopped because the PR closed or merged before this queued head could be reviewed. Automation note: agents should wait for this comment to reach PR URL: #474 Details: state=closed |
|
Current-head closeout for #474:
This PR is ready for normal merge without admin merge or auto-merge. #480 remains stacked on this head. |
2 participants
Summary
Refs #415.
Adds a disabled-by-default
repoWikiContextadvisory packet path for NeonDiff review prompts:repoWikiContext.enabled,packetPath,maxPacketBytes,includeStaleContextmarkdown, and deterministic repo-wiki packet JSONThis does not enable live daemon behavior, cron, OpenWiki generation, GitHub posting changes, or auto-edits to docs. OpenWiki remains advisory orientation only; current PR diff, checkout files, and GitHub metadata remain authoritative.
Validation
Local focused validation from
/Volumes/LEXAR/repos/worktrees/neondiff-openwiki-context-415:Result:
Offline eval-suite baseline:
Result:
OpenWiki Smoke
Evidence root:
/Volumes/LEXAR/Codex/neondiff-openwiki-context/2026-07-09/openwiki.openwiki/**; a later local converter wrote.neondiff/repo-wiki-packet.jsonas a lab artifact.openwiki/config/configuration.mdbecause it listsNEONDIFF_GITHUB_TOKEN.Conclusion: OpenWiki-derived context is promising but not clean enough for default prompt use yet. This PR ships the disabled safe seam; live/lab enablement should use a curated deterministic packet first, then rerun OpenWiki after the timeout and secret-wording issues are fixed.
Proof Boundary
This PR proves the feature-gated packet attach/degrade/redact path, not production enablement. #415 should remain open until the review-quality A/B delta is reported for deterministic and OpenWiki-derived packets.