factory: bounded explicit fingerprint timeout - #4
Open
olety wants to merge 1 commit into
Open
Conversation
PR SummaryHigh Risk Overview Factory / Oneiron (including ONE-1820): Adds a fingerprint-only Stable install under npm 12:
Process / templates: Bug report forms collect install method, OS version, CPU arch, and shell/terminal; Linear checks expect RES- tickets (with
Reviewed by Cursor Bugbot for commit 8c794d8. Bugbot is set up for automated code reviews on this repo. Configure here. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_e76fcf4f-3b66-4ff8-8526-2a82af912455) |
Member
Author
|
/agentic_review |
|
Important Review skippedToo many files! This PR contains 322 files, which is 172 over the limit of 150. To get a review, reduce the PR to 150 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to Team to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Essentials Run ID: ⛔ Files ignored due to path filters (5)
📒 Files selected for processing (322)
You can disable this status message by setting the Comment |
PR Summary by QodoBound factory fingerprint timeout via CLI
AI Description
Diagram
High-Level Assessment
Files changed (5)
|
Code Review by Qodo
1. Public compaction loses type safety
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
|
|
||
| function summaryRequestByteLimit(model: Model<any>, reserveTokens: number, maxTokens: number): number { | ||
| /** @internal Shared with deep compaction; not part of the public compaction surface. */ | ||
| export function summaryRequestByteLimit(model: Model<any>, reserveTokens: number, maxTokens: number): number { |
There was a problem hiding this comment.
1. Public compaction loses type safety 📘 Rule violation ⚙ Maintainability
summaryRequestByteLimit is newly exported with its model parameter still declared as Model<any> and no documented escape hatch. Callers can now reach this internal helper through an unchecked generic boundary, allowing incompatible model payload types to escape compiler validation.
Agent Prompt
## Issue description
The newly exported compaction helper uses `Model<any>` without a documented escape hatch.
## Issue Context
Use a concrete model payload type, `unknown`, or a constrained generic so callers retain type checking.
## Fix Focus Areas
- packages/coding-agent/src/core/compaction/compaction.ts[650-651]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| firstKeptEntryId: string; | ||
| previousSummary: string | undefined; | ||
| chunkDigests: readonly string[]; | ||
| model: Model<any>; |
There was a problem hiding this comment.
2. Resumed compaction loses type safety 📘 Rule violation ⚙ Maintainability
DeepRunIdentity.model is declared as Model<any> without an escape marker or justification. Every cached or resumed deep-compaction identity passes through this property, so incompatible model payload types are not checked at that boundary.
Agent Prompt
## Issue description
The deep-compaction run identity uses an undocumented `any` generic.
## Issue Context
Replace it with a concrete type, `unknown`, or a constrained generic shared with the surrounding compaction APIs.
## Fix Focus Areas
- packages/coding-agent/src/core/compaction/deep-compaction.ts[93-103]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+279
to
+280
| (pi: any) => { | ||
| pi.on("before_provider_request", async (payload: any) => payload); |
There was a problem hiding this comment.
3. Session tests bypass type safety 📘 Rule violation ⚙ Maintainability
The semantic-edge tests type extension callbacks and their event payloads as any at two separate setup sites without escape comments. These callbacks exercise provider-request and compaction hooks, leaving changes to both hook contracts unchecked by the compiler.
Agent Prompt
## Issue description
Two semantic-edge test callbacks use undocumented `any` parameters.
## Issue Context
Use the extension registration and hook payload types already exposed by the application, or infer them through a typed callback.
## Fix Focus Areas
- packages/coding-agent/test/agent-session-semantic-edges.test.ts[279-280]
- packages/coding-agent/test/agent-session-semantic-edges.test.ts[569-570]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| const f = fixture(); | ||
| const receiptBytes = Buffer.byteLength(readFileSync(f.packet.receipt!.path, "utf8")); | ||
| const allowance = FACTORY_EVIDENCE_LIMITS.contentBytes - receiptBytes; | ||
| const unicode = "😀".repeat(Math.floor(allowance / 4)); |
There was a problem hiding this comment.
4. Test artifacts contain forbidden emoji 📘 Rule violation ⚙ Maintainability
factory-oneiron-evidence.test.ts adds the literal 😀 to two generated test payloads. Both UTF-8 boundary tests therefore place an emoji directly in a modified source artifact, even though a non-emoji multibyte character could exercise the same byte accounting.
Agent Prompt
## Issue description
Two test payloads contain a literal emoji prohibited by the review checklist.
## Issue Context
Preserve the four-byte UTF-8 boundary coverage using escaped code points or non-emoji multibyte test data consistent with the rule.
## Fix Focus Areas
- packages/coding-agent/test/factory-oneiron-evidence.test.ts[75-75]
- packages/coding-agent/test/factory-oneiron-evidence.test.ts[174-174]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+3
to
+5
| ## [0.9.0] - 2026-09-01 | ||
|
|
||
| - Refreshed the model catalog from live provider catalogs (pricing updates, new and removed models); fixed OpenCode Go Qwen routes mislabeled as Anthropic and excluded private dev/ Prime Inference routes. |
There was a problem hiding this comment.
5. Ai release history bypasses fragments 📘 Rule violation § Compliance
packages/ai/CHANGELOG.md directly adds the dated 0.9.0 section and its entries instead of leaving release history unchanged. Because the heading denotes an already released version, the same edit also changes content inside a protected released section.
Agent Prompt
## Issue description
The AI package changelog is edited directly under a dated released version.
## Issue Context
Restore the changelog and consolidate the relevant unreleased notes into one package fragment; release automation should consume it later.
## Fix Focus Areas
- packages/ai/CHANGELOG.md[3-7]
- packages/ai/.changes/oneiron-compact-request-identity.md[1-1]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| @@ -0,0 +1 @@ | |||
| - Added a fingerprint-only `--timeout-ms` option bounded to 1–120000 ms, retaining the 20000 ms default and native Git source verification. | |||
There was a problem hiding this comment.
9. Agent changes split across fragments 📘 Rule violation § Compliance
The coding-agent package adds separate fragments for the fingerprint timeout, semantic-edge producer, and many other changes. These concurrently changed files distribute one package's release notes across far more than the permitted single fragment.
Agent Prompt
## Issue description
The coding-agent package has numerous changelog fragments in the same PR.
## Issue Context
Consolidate applicable coding-agent notes into one fragment, preserving separate bullet lines within that file.
## Fix Focus Areas
- packages/coding-agent/.changes/one-1820-fingerprint-timeout.md[1-1]
- packages/coding-agent/.changes/acp-semantic-edges-producer.md[1-1]
- packages/coding-agent/.changes/acp-semantic-edges-delivery.md[1-1]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+1
to
+3
| --- | ||
| "@earendil-works/pi-coding-agent": patch | ||
| --- |
There was a problem hiding this comment.
10. A fragment breaks the required format 📘 Rule violation ⚙ Maintainability
factory-triage-reviewed-head.md uses YAML front matter followed by an unbulleted prose paragraph rather than flat dash bullets. Release-note processing of this changed fragment therefore encounters metadata and prose outside the checklist's accepted entry structure.
Agent Prompt
## Issue description
The fragment contains YAML metadata and an unbulleted paragraph.
## Issue Context
Remove the front matter and express each user-visible change as its own `- Added`, `- Changed`, `- Fixed`, or `- Removed` line.
## Fix Focus Areas
- packages/coding-agent/.changes/factory-triage-reviewed-head.md[1-5]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| @@ -0,0 +1 @@ | |||
| - Refreshed the generated model catalog from live provider sources: 41 models added (including claude-fable-5.1, gemini-3.8-flash, and GLM-5.3 across providers) and 17 removed; GitHub Copilot tests now use claude-sonnet-4.6 and gpt-5.3-codex for the models Copilot dropped. | |||
There was a problem hiding this comment.
11. Ai release notes use a wrong verb 📘 Rule violation ⚙ Maintainability
res-1269-refresh-model-catalog.md begins its bullet with Refreshed, which is outside the allowed Added, Changed, Fixed, or Removed prefixes. The same line also combines catalog additions, removals, and test-model updates into one entry rather than keeping distinct changes separate.
Agent Prompt
## Issue description
The AI fragment uses an unapproved verb and combines several changes.
## Issue Context
Split distinct user-visible outcomes into separate flat bullets beginning with allowed past-tense prefixes.
## Fix Focus Areas
- packages/ai/.changes/res-1269-refresh-model-catalog.md[1-1]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| @@ -0,0 +1 @@ | |||
| - Registered the per-session semantic-edge ledger with the agent-traces outbox as its own kind-tagged entry: durable upload intent at persist, an append-only byte cursor that never re-counts unchanged ledgers, startup catch-up counting, and pruning when a ledger is deleted with its session. No delivery endpoint exists yet, so pending ledgers are counted but never sent. | |||
There was a problem hiding this comment.
12. Agent notes expose internal mechanics 📘 Rule violation ⚙ Maintainability
Several coding-agent fragments begin with unapproved verbs such as Registered and Extracted while describing ledgers, cursors, append flags, replay, and other implementation details. These entries surface when release notes are assembled, where they neither use the accepted prefixes nor state a concise user-visible outcome.
Agent Prompt
## Issue description
Multiple coding-agent fragments use unsupported verbs and implementation-focused wording.
## Issue Context
Rewrite each applicable entry as a concise user-visible result prefixed by `Added`, `Changed`, `Fixed`, or `Removed`.
## Fix Focus Areas
- packages/coding-agent/.changes/acp-semantic-edges-delivery.md[1-1]
- packages/coding-agent/.changes/event-log-substrate.md[1-1]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| @@ -1,5 +1,9 @@ | |||
| # Changelog | |||
|
|
|||
| ## [0.9.0] - 2026-09-01 | |||
|
|
|||
| - Add an optional `transform` hook to `Markdown` so callers can rewrite markdown with the exact content width before rendering. | |||
There was a problem hiding this comment.
13. Interface notes use present tense 📘 Rule violation ⚙ Maintainability
The new TUI changelog bullet starts with Add instead of the allowed past-tense prefix Added. It appears under the directly added 0.9.0 section, so generated release notes retain the nonconforming verb.
Agent Prompt
## Issue description
The interface changelog entry starts with present-tense `Add`.
## Issue Context
If retained in a fragment, rewrite it as a flat bullet beginning with `Added` and describe the caller-visible outcome.
## Fix Focus Areas
- packages/tui/CHANGELOG.md[5-5]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
olety
changed the base branch from
main
to
base/one1820-native-timeout-b9043d748
September 7, 2026 16:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CEO-authorized isolated prerequisite for ONE-1820. Adds fingerprint-only --timeout-ms bounded1..120000, default20000 unchanged. Launch/inspect defaults and native hash runner unchanged. Focused51 tests PASS; coding-agent tsgo build PASS. No daemon restart/hotpatch. Actual Qodo review required before focused CLI use.