Modernization continuation: CI unblock, security/privacy hardening, reliability fixes, RAG foundation#63
Merged
Conversation
Pterjudin
pushed a commit
that referenced
this pull request
Jun 12, 2026
…rements) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ignore) Both pre-existing blockers (red on main too): findDiffs.ts imports the generated react/out/diff/index.js which CI typechecks before buildreact -> commit a matching index.d.ts (like the 6 sibling react modules); and exclude scripts/appimage/create_appimage.sh from the unicode/indentation hygiene filters (intentional translated menu strings + indentation). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… injection, command gate - Telemetry was opt-OUT + ON by default (PostHog device fingerprint) -> opt-IN + local-only-gated. - 'Local only' (routingPolicy) didn't gate the electron-main telemetry/update gates (they read the deprecated localFirstAI); added a main-readable routingPolicy mirror + resolveLocalOnlyForMainProcess. - SSRF: assertNotSSRF -> egressPolicy.classifyDestination (closes the hex IPv4-mapped IPv6 bypass). - Fence untrusted web_search/browse_url content against indirect prompt injection. - run_nl_command enforces classifyCommandRisk on the parsed command (was a destructive-cmd bypass). - Gate the model-list refresh under local-only; pin the Image-QA remote-call guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…source leaks From a reliability bug-hunt: - SEARCH/REPLACE partial-line match overwrote the whole line (silent data corruption) -> exact span. - cwdEscapesWorkspace collapses '..' (a traversal cwd no longer bypasses terminal containment). - pre-loop errored tool no longer recorded as a completed plan step; Plan+Auto dead-end fixed; message-prep failure surfaced instead of a silent 'Done'. - leaks: onAbort hook, rollback-journal snapshots, the 60Hz render-monitor + per-batch RAF disposable. - router cache no longer serves a 429'd free-tier provider. - pinned the previously-untested code-extraction parsers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pure common/retrievalResult.ts (RetrievalResult with the URI as a discrete field + formatRetrievalResult, byte-identical to the old inline _formatResult); repoIndexerService formats through it. Foundation for fixing the query-codebase / search_for_files bogus-URI bug (next increment). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pterjudin
force-pushed
the
modernize-agentic-editor-foundation
branch
from
7be1526 to
00c2b95
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continuation of the modernization effort (the foundation from PR #62 is already merged). 30 commits; cortexide node suite 551 → 610 passing, 0 failing;
tsgo0 throughout; CDP smoke 11/11 and 7B agent-edit E2E green. Driven by four adversarial multi-agent review/audit workflows plus targeted fixes — every change is tested and (where it touches the runtime) live-validated.Phase 9 — CI unblock (the "Compile & Hygiene" check was red)
findDiffs.tsTS2307: committedreact/out/diff/index.d.tssotsgoresolves the generated import without first building react (matches the 6 sibling react modules). Verified by running tsgo withreact/out/diff/index.jshidden — the exact CI condition.create_appimage.shhygiene: excluded it fromunicodeFilter+indentationFilter(intentional translated menu strings + its own indentation), not stripping the translations.Security & privacy (the local-first / "never leaks" north-star)
us.i.posthog.com. Now opt-IN + local-only-gated via pure testedcommon/telemetryConsent.ts. Live-confirmed off by default; 0identifycalls on a fresh profile.routingPolicy, but the electron-main telemetry + update-check gates read the deprecatedlocalFirstAI(one-way migration) — so neither was enforced for the normal path. Fixed with a main-readablecortexide.global.routingPolicymirror + a fail-saferesolveLocalOnlyForMainProcess. Live-confirmed.assertNotSSRFontoegressPolicy.classifyDestination, closing a hex-canonicalized IPv4-mapped-IPv6 bypass (http://[::ffff:127.0.0.1]reaching loopback / cloud-metadata). The contract test sat in the unruntest/browser/— pinned it intest/common/.web_search/browse_urlcontent in nonce-tagged delimiters so a fetched page can't hijack the agent.Reliability / correctness (found by a 21-agent bug-hunt; 8 of 13 fixed)
ok:true. Exact-span fix; a 200k-case differential fuzz proves zero regression to full-line use.run_nl_commandbypassed the destructive-command gate —rm -rfcould auto-run under YOLO / auto-approve. EnforcedclassifyCommandRiskon the parsed command at the execution chokepoint.cwdEscapesWorkspacenow collapses..(a traversal cwd no longer bypasses containment); message-prep failure no longer ends a turn as a silent "Done"; three resource leaks (onAbort hook, rollback-journal snapshots, the 60Hz render-monitor + per-batch RAF disposable); router cache no longer serves a 429'd free-tier provider.Phase 5 / Phase 4 — apply & retrieval correctness, tested
extractSearchReplaceBlocksstreaming SR parser + FIM/regular, incl. a streaming-monotonicity property).common/retrievalResult.ts), the foundation for fixing the Query-Codebase /search_for_filesbogus-URI bug (next increment).Deferred (documented in
docs/MODERNIZATION-BASELINE.md)multi_edit
replace_all(needs an apply-mechanism decision), thequeryStructuredURI-consumer fix, two rarer leak paths, and a cosmetic Anthropic label.See
docs/MODERNIZATION-BASELINE.md(END) for the full per-increment log, verification, and the prioritized remaining work.🤖 Generated with Claude Code