Harden agent UX and Sentry global option handling#38
Merged
Conversation
Reviewer's GuideThis PR hardens CLI UX around events and calendar options, fixes global option handling for Sentry-related command-like extensions, and updates agent metadata/history, with targeted unit and integration tests to guard the new behaviors. Sequence diagram for getGlobalOptions fallback handlingsequenceDiagram
actor User
participant Command as CommandLike
participant Helpers as registration_helpers
User->>Helpers: getGlobalOptions(command)
Helpers->>Command: optsWithGlobals()
alt [optsWithGlobals is a function]
Command-->>Helpers: optsWithGlobals result
else [optsWithGlobals missing]
Helpers->>Command: opts()
alt [opts is a function]
Command-->>Helpers: opts result
else [opts missing]
Helpers-->>Helpers: use empty options {}
end
end
Helpers-->>User: GlobalOptions { json, quiet, verbose, debug }
Flow diagram for event start/end validation in create and update commandsflowchart TD
A[parseEvents / parseEventEntries] --> B[resolveIsoOrRelative for startAt]
B --> C[resolveIsoOrRelative for endAt]
C --> D{endAt exists and endAt <= startAt?}
D -->|Yes| E[throw PmCliError with message --event end must be after start; equal start/end timestamps are invalid. Omit end for an instant event or set end later than start.]
D -->|No| F[Continue building CalendarEvent and proceed]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR extracts shared event validation messaging, adds support for scheduled events in the calendar extension, improves global option resolution resilience in registration helpers, refines body field tracking in create operations, and comprehensively documents audit completion and feature implementation status across PM metadata files. ChangesEvent Validation and Feature Completion
🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Fix remaining safe pm-5k2w polish by omitting body from create changed_fields when no body was supplied, documenting the calendar scheduled include alias in package help/completions, and giving equal event start/end timestamps actionable recovery guidance. Fix Sentry PM-CLI-T by making getGlobalOptions tolerate command-like extension objects without optsWithGlobals, with focused unit coverage. Sanitize tracked pm evidence by removing private local-ops wording from pm-h4zb and pm-5jw8 current items/history through pm commands and history-redact. Verification: focused regression suite passed (5 files, 208 tests); manual isolated temp smoke passed; pnpm build passed; pnpm quality:static passed; node scripts/check-secrets.mjs passed; node scripts/dogfood-package-first.mjs passed; node scripts/release/run-gates.mjs --telemetry-mode required --max-sentry-critical 10 --max-sentry-high 20 --max-telemetry-error-rate 10 --json passed with 97 files / 1408 tests and 100% coverage; Sentry PM-CLI-T resolved and unresolved issue list is empty.
unbraind
force-pushed
the
codex/pm-cli-extensive-polish-20260521
branch
from
b222cc8 to
56c60d7
Compare
Owner
Author
|
@coderabbitai review |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The new equal start/end validation message is duplicated in both
parseEventsandparseEventEntries; consider extracting it into a shared constant to keep UX text consistent over time. - In
getGlobalOptions, the broadcommand as Command & { ... }cast and runtime checks onoptsWithGlobals/optscould be tightened by introducing a smallCommandLikeinterface or type guard, which would make the fallback behavior clearer and easier to maintain.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new equal start/end validation message is duplicated in both `parseEvents` and `parseEventEntries`; consider extracting it into a shared constant to keep UX text consistent over time.
- In `getGlobalOptions`, the broad `command as Command & { ... }` cast and runtime checks on `optsWithGlobals`/`opts` could be tightened by introducing a small `CommandLike` interface or type guard, which would make the fallback behavior clearer and easier to maintain.
## Individual Comments
### Comment 1
<location path="src/cli/commands/create.ts" line_range="1080" />
<code_context>
}
-function buildChangedFields(frontMatter: ItemMetadata, explicitUnsets: string[]): string[] {
+function buildChangedFields(frontMatter: ItemMetadata, body: string, explicitUnsets: string[]): string[] {
const changed = [
...FRONT_MATTER_KEY_ORDER.filter((key) => frontMatter[key] !== undefined),
- "body",
+ ...(body.length > 0 ? ["body"] : []),
...explicitUnsets.map((key) => `unset:${key}`),
];
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Revisit how an empty or whitespace-only body is treated when computing changed fields.
Previously, `"body"` was always in `changedFields`, even when empty. Now it’s only added when `body.length > 0`, which changes semantics for callers that explicitly clear the body. If you only want to treat non-whitespace content as a change, consider `body.trim().length > 0`. If you instead want to preserve the old behavior while omitting `"body"` when it was never provided, this condition likely needs to depend on how the body was sourced (explicit vs default), not just its length.
```suggestion
// Treat only non-whitespace body content as a change
...(body.trim().length > 0 ? ["body"] : []),
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| const changed = [ | ||
| ...FRONT_MATTER_KEY_ORDER.filter((key) => frontMatter[key] !== undefined), | ||
| "body", | ||
| ...(body.length > 0 ? ["body"] : []), |
There was a problem hiding this comment.
suggestion (bug_risk): Revisit how an empty or whitespace-only body is treated when computing changed fields.
Previously, "body" was always in changedFields, even when empty. Now it’s only added when body.length > 0, which changes semantics for callers that explicitly clear the body. If you only want to treat non-whitespace content as a change, consider body.trim().length > 0. If you instead want to preserve the old behavior while omitting "body" when it was never provided, this condition likely needs to depend on how the body was sourced (explicit vs default), not just its length.
Suggested change
| ...(body.length > 0 ? ["body"] : []), | |
| // Treat only non-whitespace body content as a change | |
| ...(body.trim().length > 0 ? ["body"] : []), |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: Length of output: 117623 🏁 Script executed: Length of output: 508 🏁 Script executed: Length of output: 2458 🏁 Script executed: Length of output: 865
Review SummaryThe PR is well-structured and thoroughly verified. Five distinct areas are changed — all with regression tests. No critical issues were found.
|
Centralize event timestamp recovery text so create and update stay aligned, tighten the command option fallback helper used by getGlobalOptions, and rename the fallback test for clarity. Documented the review response and verification evidence in pm-5k2w. Verification: focused 5-file suite passed with 208 tests and pnpm build passed.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements several CLI polish items and bug fixes. It adds a scheduled option to the calendar command's --include flag and updates shell completions accordingly. The create command was updated to avoid reporting body in changed_fields when it is empty, and error messages for invalid event timestamps were made more descriptive. Additionally, a fallback was added to getGlobalOptions to prevent crashes when optsWithGlobals is unavailable. Review feedback suggests simplifying the implementation of this fallback using optional chaining.
I am having trouble creating individual review comments. Click here to see my feedback.
src/cli/registration-helpers.ts (62-70)
The logic for retrieving options can be simplified using optional chaining and the nullish coalescing operator, which improves readability and reduces verbosity.
const opts = (command as any).optsWithGlobals?.() ?? (command as any).opts?.() ?? {};![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/pm/history/pm-rnpb.jsonl:
- Around line 429-441: The commit directly modified the system-of-record file
.agents/pm/history/pm-rnpb.jsonl (entries added/replaced) which violates the
rule that .agents/pm/** must be updated only via the pm command; revert these
direct edits to pm-rnpb.jsonl to the prior state and remove the patch/appended
entries, then reapply any needed changes by running the approved CLI flow (pm
<appropriate subcommand> or the documented pm workflow) so the system properly
updates metadata/comments/files/tests; specifically restore the previous
pm-rnpb.jsonl content and perform the updates via the pm command rather than
editing .agents/pm/history/pm-rnpb.jsonl manually.
In @.agents/pm/issues/pm-h4zb.toon:
- Around line 2-3: This change directly edited the system-of-record `.agents/pm`
entry (`.agents/pm/issues/pm-h4zb.toon`) which is forbidden; revert the manual
edits and reapply the intended updates by running the PM workflow/tooling (use
the PM commands that generate `.agents/pm` artifacts), regenerate the files so
the modified content (the hardened secret-scan rules and local-only note) is
produced by the toolchain, and commit the generated artifacts instead of
hand-editing—also ensure any related lines referenced (lines around 9-15 and 21)
are handled through the same PM tooling rather than manual changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 665133b2-fe6f-4eb9-8560-61340bcf4f01
📒 Files selected for processing (20)
.agents/pm/chores/pm-5jw8.toon.agents/pm/chores/pm-5k2w.toon.agents/pm/features/pm-rnpb.toon.agents/pm/history/pm-5jw8.jsonl.agents/pm/history/pm-5k2w.jsonl.agents/pm/history/pm-h4zb.jsonl.agents/pm/history/pm-rnpb.jsonl.agents/pm/issues/pm-h4zb.toonpackages/pm-calendar/extensions/calendar/index.jspackages/pm-calendar/extensions/calendar/index.tssrc/cli/commands/completion.tssrc/cli/commands/create.tssrc/cli/commands/event-validation-messages.tssrc/cli/commands/update.tssrc/cli/registration-helpers.tstests/integration/release-readiness-runtime.spec.tstests/unit/completion-command.spec.tstests/unit/create-command.spec.tstests/unit/registration-helpers.spec.tstests/unit/update-command.spec.ts
Comment on lines
+429
to
+441
| {"ts":"2026-05-21T18:12:21.032Z","author":"codex-extensive-audit","op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:12:21.032Z"},{"op":"add","path":"/metadata/assignee","value":"codex-extensive-audit"}],"before_hash":"0ac9b985ff20cf811dc82d5b031261929b51ab3fdae17649ae09e6bd8f3ce0ac","after_hash":"ee886a9fe164eb1fd157a3a4a3eeb493abc7eb855e051e63782fd6bce78c06c0","message":"Continue latest extensive audit/remediation pass with sub-agent lanes, temp-project manual dogfood, telemetry/Sentry review, PR/CI follow-through."} | ||
| {"ts":"2026-05-21T18:12:38.387Z","author":"codex-extensive-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/163","value":{"created_at":"2026-05-21T18:12:38.387Z","author":"codex-extensive-audit","text":"Execution plan 2026-05-21: reuse pm-rnpb parent and pm-5k2w child after duplicate checks; use sub-agent lanes for privacy/history scan plus observability/GitHub review; locally implement remaining safe pm-5k2w agent-UX/token-efficiency fixes; verify with focused tests, secret scan, temp-project dogfood, health/validate, Sentry/telemetry gates, PR checks, AI review wait, review fixes, and merge only if green."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:12:38.387Z"}],"before_hash":"ee886a9fe164eb1fd157a3a4a3eeb493abc7eb855e051e63782fd6bce78c06c0","after_hash":"aafa063831032882823391299bf52c75fd11030dcb2d9e7d3930a7c862e16d7a"} | ||
| {"ts":"2026-05-21T18:13:32.401Z","author":"codex-observability-review","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/164","value":{"created_at":"2026-05-21T18:13:32.401Z","author":"codex-observability-review","text":"Investigation note: starting no-edit observability/GitHub review lane. Bootstrap passed: npm install -g . was up to date, pm --version 2026.5.18, node v25.9.0, pnpm 10.33.0, pnpm build passed. Orientation reused parent pm-rnpb; no new pm items created."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:13:32.401Z"}],"before_hash":"aafa063831032882823391299bf52c75fd11030dcb2d9e7d3930a7c862e16d7a","after_hash":"9998c41756e25997f644d1bea2fd9994516d67216c4f863c12d1b135d2d15a57"} | ||
| {"ts":"2026-05-21T18:16:00.929Z","author":"codex-observability-review","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/165","value":{"created_at":"2026-05-21T18:16:00.929Z","author":"codex-observability-review","text":"Observability/GitHub review evidence 2026-05-21: GitHub via gh has no open PRs and no open issues. Latest main CI run 26243975511 on 5fa8e579 passed; recent scheduled Nightly Validation run 26213241053 failed only on Windows Node 20 in tests/unit/check-secrets.spec.ts with SyntaxError, but later main CI passed on newer HEAD, so treat as stale unless it repeats. Sentry CLI is reachable: unresolved issues show one high-priority group PM-CLI-T (command.optsWithGlobals is not a function, getGlobalOptions path, first/last seen 2026-05-21T04:28Z, count 1); last-24h also includes resolved PM-CLI-R and PM-CLI-S. Repo sentry/telemetry gate in best-effort mode passes with Sentry critical=0 high=1 total=1, but required telemetry freshness is blocked because ignored private telemetry SSH target is unreachable; public telemetry endpoint/health probe returns upstream-origin error and pm health reports telemetry_queue_pending:57. Actionable blockers: investigate PM-CLI-T extension command global option handling, restore private telemetry stack reachability/origin health, and rerun required telemetry gate after stack recovery. Sensitive host details intentionally omitted."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:16:00.929Z"}],"before_hash":"9998c41756e25997f644d1bea2fd9994516d67216c4f863c12d1b135d2d15a57","after_hash":"61eff56461342863b4bbe9ea401bc059b50c5f589e6e9c06aba9c946667cf553"} | ||
| {"ts":"2026-05-21T18:17:29.463Z","author":"codex-extensive-audit","op":"files_add","patch":[{"op":"replace","path":"/metadata/files/92/note","value":"update event date alias regression"},{"op":"replace","path":"/metadata/files/92/path","value":"tests/unit/update-command.spec.ts"},{"op":"replace","path":"/metadata/files/91/note","value":"regression for nested sentry event scrub behavior"},{"op":"replace","path":"/metadata/files/91/path","value":"tests/unit/sentry-helpers.spec.ts"},{"op":"replace","path":"/metadata/files/90/note","value":"qwen Ollama model preference regression"},{"op":"replace","path":"/metadata/files/90/path","value":"tests/unit/semantic-defaults.spec.ts"},{"op":"replace","path":"/metadata/files/89/note","value":"unit coverage for semantic corpus helper branches"},{"op":"replace","path":"/metadata/files/89/path","value":"tests/unit/search-corpus.spec.ts"},{"op":"replace","path":"/metadata/files/88/note","value":"regression for reminder/event search matches"},{"op":"replace","path":"/metadata/files/88/path","value":"tests/unit/search-command.spec.ts"},{"op":"replace","path":"/metadata/files/87/note","value":"regression for bounded semantic refresh corpus input"},{"op":"replace","path":"/metadata/files/87/path","value":"tests/unit/search-cache.spec.ts"},{"op":"replace","path":"/metadata/files/86/note","value":"direct package runtime coverage"},{"op":"replace","path":"/metadata/files/86/path","value":"tests/unit/search-advanced-runtime.spec.ts"},{"op":"replace","path":"/metadata/files/85/note","value":"regression for malformed config token normalization"},{"op":"replace","path":"/metadata/files/85/path","value":"tests/unit/runtime-schema-command-flags.spec.ts"},{"op":"replace","path":"/metadata/files/84/note","value":"PM-CLI-T regression coverage"},{"op":"replace","path":"/metadata/files/84/path","value":"tests/unit/registration-helpers.spec.ts"},{"op":"add","path":"/metadata/files/93","value":{"path":"vitest.config.ts","scope":"project","note":"coverage include list covers new search corpus helper"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:17:29.463Z"}],"before_hash":"61eff56461342863b4bbe9ea401bc059b50c5f589e6e9c06aba9c946667cf553","after_hash":"c38712ef7a78fc74591a1b8f32b5d57cb47a6aba6033968c306310cb57bcc56f"} | ||
| {"ts":"2026-05-21T18:17:29.579Z","author":"codex-extensive-audit","op":"tests_add","patch":[{"op":"replace","path":"/metadata/tests/45/note","value":"docs and skills gate"},{"op":"replace","path":"/metadata/tests/45/command","value":"pnpm quality:docs-skills"},{"op":"replace","path":"/metadata/tests/44/note","value":"focused init defaults integration regression"},{"op":"replace","path":"/metadata/tests/44/timeout_seconds","value":120},{"op":"replace","path":"/metadata/tests/44/command","value":"pnpm exec vitest run tests/integration/cli.integration.spec.ts -t 'accepts agent-friendly non-interactive init defaults and author'"},{"op":"replace","path":"/metadata/tests/43/note","value":"focused typecheck after schema changes"},{"op":"replace","path":"/metadata/tests/43/timeout_seconds","value":300},{"op":"replace","path":"/metadata/tests/43/command","value":"pnpm exec tsc --noEmit -p tsconfig.json"},{"op":"replace","path":"/metadata/tests/42/note","value":"full remediation verification gate"},{"op":"replace","path":"/metadata/tests/42/timeout_seconds","value":1200},{"op":"replace","path":"/metadata/tests/42/command","value":"pnpm build && node scripts/run-tests.mjs coverage && pnpm quality:static && node scripts/check-secrets.mjs"},{"op":"replace","path":"/metadata/tests/41/note","value":"compile CLI after health/help/dogfood changes"},{"op":"replace","path":"/metadata/tests/41/timeout_seconds","value":300},{"op":"replace","path":"/metadata/tests/41/command","value":"pnpm build"},{"op":"replace","path":"/metadata/tests/40/note","value":"focused dependency/UX/Sentry regression suite"},{"op":"replace","path":"/metadata/tests/40/timeout_seconds","value":600},{"op":"replace","path":"/metadata/tests/40/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/search-command.spec.ts tests/unit/status-normalization.spec.ts tests/unit/extension-command.spec.ts tests/unit/contracts-command.spec.ts tests/unit/error-guidance.spec.ts"},{"op":"replace","path":"/metadata/tests/39/note","value":"focused Sentry crash and package contract hint regression suite"},{"op":"replace","path":"/metadata/tests/39/timeout_seconds","value":300},{"op":"replace","path":"/metadata/tests/39/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/search-command.spec.ts tests/unit/runtime-schema-command-flags.spec.ts tests/unit/contracts-command.spec.ts"},{"op":"replace","path":"/metadata/tests/38/note","value":"focused package docs search UX regressions"},{"op":"replace","path":"/metadata/tests/38/timeout_seconds","value":900},{"op":"replace","path":"/metadata/tests/38/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/search-cache.spec.ts tests/unit/extension-command.spec.ts tests/integration/help-runtime.spec.ts"},{"op":"replace","path":"/metadata/tests/37/note","value":"SDK workspace contracts,Plan fields,search-advanced package regression"},{"op":"replace","path":"/metadata/tests/37/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/sdk-index.spec.ts tests/unit/plan-command.spec.ts tests/integration/release-readiness-runtime.spec.ts"},{"op":"replace","path":"/metadata/tests/36/note","value":"focused SDK and Plan projection regression"},{"op":"replace","path":"/metadata/tests/36/timeout_seconds","value":240},{"op":"replace","path":"/metadata/tests/36/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/sdk-index.spec.ts tests/unit/plan-command.spec.ts"},{"op":"replace","path":"/metadata/tests/35/note","value":"focused SDK contracts search-advanced regression"},{"op":"replace","path":"/metadata/tests/35/timeout_seconds","value":900},{"op":"replace","path":"/metadata/tests/35/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/sdk-index.spec.ts tests/unit/contracts-command.spec.ts tests/unit/search-advanced-runtime.spec.ts tests/integration/release-readiness-runtime.spec.ts"},{"op":"replace","path":"/metadata/tests/34/note","value":"SDK runtime contracts regression"},{"op":"replace","path":"/metadata/tests/34/timeout_seconds","value":300},{"op":"replace","path":"/metadata/tests/34/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/sdk-index.spec.ts tests/unit/contracts-command.spec.ts"},{"op":"replace","path":"/metadata/tests/33/note","value":"focused PM-CLI-T and pm-5k2w UX regressions"},{"op":"replace","path":"/metadata/tests/33/timeout_seconds","value":900},{"op":"replace","path":"/metadata/tests/33/command","value":"PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/registration-helpers.spec.ts tests/unit/create-command.spec.ts tests/unit/update-command.spec.ts tests/unit/completion-command.spec.ts tests/integration/release-readiness-runtime.spec.ts --reporter=dot"},{"op":"add","path":"/metadata/tests/46","value":{"command":"pnpm quality:static","scope":"project","timeout_seconds":300,"note":"static quality gate"}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:17:29.579Z"}],"before_hash":"c38712ef7a78fc74591a1b8f32b5d57cb47a6aba6033968c306310cb57bcc56f","after_hash":"04bcf15adb9318eb5b0208fb7f44c26afb648c299658b7eb00d34952d7ea849e"} | ||
| {"ts":"2026-05-21T18:18:21.256Z","author":"codex-extensive-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/166","value":{"created_at":"2026-05-21T18:18:21.256Z","author":"codex-extensive-audit","text":"Evidence update: focused regression suite passed after PM-CLI-T and pm-5k2w fixes: PM_RUN_TESTS_SKIP_BUILD=1 node scripts/run-tests.mjs test -- tests/unit/registration-helpers.spec.ts tests/unit/create-command.spec.ts tests/unit/update-command.spec.ts tests/unit/completion-command.spec.ts tests/integration/release-readiness-runtime.spec.ts --reporter=dot (5 files, 208 tests). Privacy lane found no raw secrets/private keys/private IP/user@host leaks; sanitized private local-ops wording from pm-h4zb and pm-5jw8 item/history using pm update, pm docs, and pm history-redact."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:18:21.256Z"}],"before_hash":"04bcf15adb9318eb5b0208fb7f44c26afb648c299658b7eb00d34952d7ea849e","after_hash":"fe57189895dcf0bba31f729f078b1ff0261941b667d4c9c3e8406845867ff69f"} | ||
| {"ts":"2026-05-21T18:19:29.415Z","author":"codex-extensive-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/167","value":{"created_at":"2026-05-21T18:19:29.415Z","author":"codex-extensive-audit","text":"Verification update: pnpm build passed, pnpm quality:static passed, node scripts/check-secrets.mjs passed, and manual isolated temp smoke passed after installing calendar + guide-shell. The initial manual smoke also validated optional-package guidance by failing completion before guide-shell install with an install hint."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:19:29.415Z"}],"before_hash":"fe57189895dcf0bba31f729f078b1ff0261941b667d4c9c3e8406845867ff69f","after_hash":"133957f97c803040057a4356723bfbb44b5d77be98c4a88639afeaee9b0a57a6"} | ||
| {"ts":"2026-05-21T18:20:20.705Z","author":"codex-extensive-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/168","value":{"created_at":"2026-05-21T18:20:20.705Z","author":"codex-extensive-audit","text":"Verification update: node scripts/dogfood-package-first.mjs passed in isolated temp project with 84 workflows. Slowest expected command was linked test run; create/close/release/docs/claim remained functional. Running full release gate with required telemetry next."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:20:20.705Z"}],"before_hash":"133957f97c803040057a4356723bfbb44b5d77be98c4a88639afeaee9b0a57a6","after_hash":"6295c3ba4de3ec13f7ab931f0618271d50ed21ccb1a31b9cc349e19f1da99a95"} | ||
| {"ts":"2026-05-21T18:20:22.085Z","author":"codex-extensive-audit","op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:20:22.085Z"}],"before_hash":"6295c3ba4de3ec13f7ab931f0618271d50ed21ccb1a31b9cc349e19f1da99a95","after_hash":"ae3a93659a1c9ac0f7455ae2051b987bc45dab9267a84d4d111db9232d849682"} | ||
| {"ts":"2026-05-21T18:25:20.991Z","author":"codex-extensive-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/169","value":{"created_at":"2026-05-21T18:25:20.991Z","author":"codex-extensive-audit","text":"Release gate evidence: node scripts/release/run-gates.mjs --telemetry-mode required --max-sentry-critical 10 --max-sentry-high 20 --max-telemetry-error-rate 10 --json passed. Coverage: 97 files / 1408 tests, 100 percent statements/branches/functions/lines. Gate checks passed: build, typecheck, docs-skills, static quality, version policy, secret scan, npx packed smoke, package-first dogfood 84 workflows, npm pack dry-run, compatibility, and Sentry/telemetry required gate (Sentry critical=0 high=1 total=1 under threshold; telemetry finish_error_rate_pct=3.27, missing error-code rows=0)."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:25:20.991Z"}],"before_hash":"ae3a93659a1c9ac0f7455ae2051b987bc45dab9267a84d4d111db9232d849682","after_hash":"5b2fd7c97ae30798518c42f8a8df1feb957adfba4dfd4c176a181edcaa3d2369"} | ||
| {"ts":"2026-05-21T18:25:22.009Z","author":"codex-extensive-audit","op":"tests_add","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:25:22.009Z"}],"before_hash":"5b2fd7c97ae30798518c42f8a8df1feb957adfba4dfd4c176a181edcaa3d2369","after_hash":"3b9af761103161e3bc084e3c3d7ae0259d512c80e9a80525f67837bb25671d20"} | ||
| {"ts":"2026-05-21T18:25:44.947Z","author":"codex-extensive-audit","op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/170","value":{"created_at":"2026-05-21T18:25:44.947Z","author":"codex-extensive-audit","text":"Observability closeout: Sentry PM-CLI-T was fixed with getGlobalOptions fallback coverage and resolved via sentry CLI; sentry issue list --query is:unresolved now returns no unresolved issues. pm health --check-only --brief --json is ok with no warnings; telemetry queue is draining with recent successful flush at 2026-05-21T18:25:22.812Z and no failed flush."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-05-21T18:25:44.947Z"}],"before_hash":"3b9af761103161e3bc084e3c3d7ae0259d512c80e9a80525f67837bb25671d20","after_hash":"c08a99a1a8220517726146963e90fcf95d5dbc9fe23a9c2c7368b93e731096fa"} |
There was a problem hiding this comment.
Do not commit direct edits under .agents/pm system-of-record files.
These appended history entries directly modify .agents/pm/history/pm-rnpb.jsonl, which violates repository process rules. Please revert these direct file edits and apply updates only through the approved pm command flow that manages system-of-record artifacts.
As per coding guidelines, .agents/pm/**: pm is the system of record. Do not edit .agents/pm files directly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/pm/history/pm-rnpb.jsonl around lines 429 - 441, The commit directly
modified the system-of-record file .agents/pm/history/pm-rnpb.jsonl (entries
added/replaced) which violates the rule that .agents/pm/** must be updated only
via the pm command; revert these direct edits to pm-rnpb.jsonl to the prior
state and remove the patch/appended entries, then reapply any needed changes by
running the approved CLI flow (pm <appropriate subcommand> or the documented pm
workflow) so the system properly updates metadata/comments/files/tests;
specifically restore the previous pm-rnpb.jsonl content and perform the updates
via the pm command rather than editing .agents/pm/history/pm-rnpb.jsonl
manually.
Comment on lines
+2
to
+3
| title: Harden secret-scan guardrail for GitHub token prefixes and local credential hygiene | ||
| description: "A privacy re-audit confirmed the public shipping surface is clean and identified scanner coverage gaps for additional GitHub token prefixes plus a local-only ignored operations note that needed credential hygiene. The implementation broadened scanner coverage, made the rules unit-testable, and removed the local plaintext credential reference without tracking private operations details." |
There was a problem hiding this comment.
Do not directly modify .agents/pm records.
This file was edited directly, but .agents/pm is designated as the system of record and must be updated via the PM workflow/tooling instead of manual file edits. Please regenerate these changes through the PM commands and commit the resulting artifacts.
As per coding guidelines, .agents/pm/**: pm is the system of record. Do not edit .agents/pm files directly.
Also applies to: 9-15, 21-21
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/pm/issues/pm-h4zb.toon around lines 2 - 3, This change directly
edited the system-of-record `.agents/pm` entry
(`.agents/pm/issues/pm-h4zb.toon`) which is forbidden; revert the manual edits
and reapply the intended updates by running the PM workflow/tooling (use the PM
commands that generate `.agents/pm` artifacts), regenerate the files so the
modified content (the hardened secret-scan rules and local-only note) is
produced by the toolchain, and commit the generated artifacts instead of
hand-editing—also ensure any related lines referenced (lines around 9-15 and 21)
are handled through the same PM tooling rather than manual changes.
Owner
Author
|
Review follow-up: I reviewed Gemini Code Assist suggestion to simplify getGlobalOptions with optional chaining and any casts. I am keeping the explicit CommandOptionsReader helper because it addresses Sourcery’s maintainability feedback without reintroducing any, while preserving the same fallback behavior. No code change needed. |
Owner
Author
|
Review follow-up on remaining comments: Sourcery body changed_fields comment was checked and intentionally left as body.length because this fix only omits the default empty body; explicit whitespace body content remains user-supplied content. CodeRabbit .agents/pm findings are false positives: pm-rnpb entries were generated by pm CLI operations during this run, and pm-h4zb was generated via history-redact plus update-audit; pm history pm-h4zb --verify reports ok=true. I did not revert valid system-of-record history. |
Record the green post-feedback CI run, bot review disposition, and release the active pm claims for pm-5k2w and pm-rnpb through the pm CLI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
Observability
pm Items
Summary by Sourcery
Harden CLI agent UX for calendar events and global option handling while aligning calendar include options and updating tracked agent artifacts.
Bug Fixes:
Enhancements:
Tests: