fix(workbench): bind finding excerpts to selected source paths - #636
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 566f5c4de7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ff61b6145
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if process.stdout.read(1): | ||
| if process.poll() is None: | ||
| process.kill() | ||
| return False |
There was a problem hiding this comment.
When a repository contains any active replacement ref—even one for an unrelated historical object—this branch suppresses every source excerpt. All subsequent object reads already pass --no-replace-objects, which Git documents as disabling replacement refs, so the refs cannot alter the tree or blob being displayed; probing for their mere presence introduces an unnecessary output regression for repositories that legitimately use git replace.
AGENTS.md reference: AGENTS.md:L19-L22
Useful? React with 👍 / 👎.
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03af8b7137
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6fd4128627
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
1 participant
Summary
Bind optional finding source excerpts to the source paths and exact Git tree selected when a scan starts. Reuse immutable tree traversal across findings, keep expensive target verification outside database writer transactions, and preserve fail-closed handling for actual aliases, linked ancestry, and replacement-object views.
Changes
GIT_REPLACE_REF_BASEwhile omitting optional excerpts for malformed, mutable, changed, or legacy scan targets.0.1.46to0.1.47, preserving the parent stack's installed-plugin safety-forwarding coverage.Testing
bun test --timeout 90000 tests-ts/workbench-source-excerpt.test.ts: 4 passed; 39 expectations.bun test --timeout 90000 tests-ts/diff-rank-input.test.ts: 6 passed; 97 expectations, including concurrent parent replacement, transient Windows sharing and lock violations, and installed safety forwarding.bun test --timeout 90000 tests-ts/cost.test.ts: 60 passed; 183 expectations../node_modules/.bin/tsc --noEmitnode scripts/generate-models.cjs --checknode --run buildnpm pack --ignore-scriptsandnode scripts/check-package.mjs <tarball> plugin-files.json: validated all 265 package entries.git show --check HEADRisk and rollout
The migration only adds nullable metadata. Existing scans continue to work and omit optional excerpts when source authority is absent. Replacement-ref checks remain unchanged and fail closed, while actual filesystem aliases remain rejected even when immutable tree entries are reused or the target is a Git subdirectory. Committed-scan scope kinds use the narrower of the current checkout and selected tree. Full target verification occurs before obtaining a writer lock, and the existing checkout device/inode identity check remains inside the transaction. The bundled plugin version refreshes installed caches, while the parent stack retains its existing safety-forwarding and cross-platform confinement coverage.
Public disclosure review