fix(score): validate PDF bridge byte arrays without coercion - #750
fix(score): validate PDF bridge byte arrays without coercion#750seonghobae wants to merge 15 commits into
Conversation
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Comment |
|
@coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
|
@opencode-agent @cwl-noema-review Please independently review exact current head @coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
repo='ContextualWisdomLab/bandscope'
pr='750'
echo '=== Checked-out commit ==='
git rev-parse HEAD
echo '=== Expected commit object ==='
git rev-parse "${expected}^{commit}"
echo '=== PR metadata and current head ==='
gh pr view "$pr" --repo "$repo" --json number,url,headRefName,headRefOid,baseRefName,files,commits,statusCheckRollup \
--jq '{number,url,headRefName,headRefOid,baseRefName,files:[.files[].path],commits:[.commits[].oid],checks:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}]}'
echo '=== Changed-file names and stat against develop ==='
git diff --name-status develop..."$expected"
git diff --stat develop..."$expected"
echo '=== Full scoped diff ==='
git diff --no-ext-diff --unified=80 develop..."$expected" -- \
apps/desktop/src/features/score/scoreStorage.ts \
apps/desktop/src/features/score/scoreStorage.test.ts \
package-lock.json
echo '=== Relevant source outline ==='
ast-grep outline apps/desktop/src/features/score/scoreStorage.ts --items all
ast-grep outline apps/desktop/src/features/score/scoreStorage.test.ts --items all
echo '=== Nested lockfiles and workflow/authority changes ==='
fd -HI '(^|/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' . \
-E .git -E node_modules | sort
git diff --name-only develop..."$expected" | rg '(^|/)(\.github/workflows/|package-lock\.json$|npm-shrinkwrap\.json$|yarn\.lock$|pnpm-lock\.yaml$)' || true
echo '=== Undici entries in lockfile ==='
rg -n -C 3 '"node_modules/undici"|"undici":' package-lock.jsonLength of output: 26746 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
strix_run='30905262853'
strix_job='91978764354'
coverage_run='30905262795'
coverage_job='91983961980'
echo '=== Failed strix job metadata ==='
gh api "repos/${repo}/actions/jobs/${strix_job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion,number}]}'
echo '=== Failed strix job log tail ==='
gh run view "$strix_run" --repo "$repo" --job "$strix_job" --log-failed 2>&1 | tail -n 250
echo '=== Queued coverage job metadata ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion,number}]}'
echo '=== Latest PR check states ==='
gh pr view 750 --repo "$repo" --json headRefOid,statusCheckRollup \
--jq '{headRefOid,checks:[.statusCheckRollup[]|select(.name=="strix" or .name=="coverage-source-tree")|{name,status,conclusion,detailsUrl}]}'Length of output: 5019 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
strix_job='91978764354'
coverage_job='91983961980'
echo '=== Exact PR head and selected checks ==='
gh api "repos/${repo}/commits/74bb1fe30dc9c12e41e8ec015a64d084213d7b64/check-runs?per_page=100" \
--jq '{head_sha,check_runs:[.check_runs[]|select(.name=="strix" or .name=="coverage-source-tree")|{name,status,conclusion,details_url,started_at,completed_at,output}]}'
echo '=== Coverage job ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion}]}'
echo '=== Download and inspect Strix job log archive ==='
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmpdir/strix-logs.zip"
unzip -l "$tmpdir/strix-logs.zip"
unzip -p "$tmpdir/strix-logs.zip" | tail -n 300Length of output: 2958 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
check_run='91978764354'
echo '=== Strix check annotations ==='
gh api "repos/${repo}/check-runs/${check_run}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,title,message,raw_details}'
echo '=== Strix job-log endpoint response headers ==='
gh api -i "repos/${repo}/actions/jobs/${check_run}/logs" | sed -n '1,80p'Length of output: 6266 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
strix_job='91978764354'
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmp"
echo '=== Run Strix step and following output ==='
rg -n -A160 -i 'Run Strix \(quick\)|::error|error:|exception|traceback|failed|failure|exit code' "$tmp" \
| tail -n 400
echo '=== Final 180 log lines ==='
tail -n 180 "$tmp"Length of output: 67235
The three-file scope is correct. No workflow, permission, nested-lockfile, filesystem, network, or IPC authority change exists.
The root lockfile changes I cannot approve yet:
The successful build, test, audit, and other security checks are insufficient while these two conditions remain unresolved. ✅ Action performedReview finished.
|
|
@opencode-agent @cwl-noema-review Please independently review exact head |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head74bb1fe30dc9c12e41e8ec015a64d084213d7b64. -
Head SHA:
74bb1fe30dc9c12e41e8ec015a64d084213d7b64 -
Workflow run: 30981152078
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
|
|
@coderabbitai review Please review exact current head @opencode-agent Please rerun review for this exact head after the central npm-workspace coverage materializer is available; do not reuse the failed predecessor coverage-evidence result. @cwl-noema-review Please independently review this exact head. Merge remains subject to protected current-head checks and a qualifying non-author approval. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
sha='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
echo '=== Local and requested commit ==='
git rev-parse HEAD
git rev-parse "${sha}^{commit}"
echo '=== PR metadata and exact-head checks ==='
gh pr view 750 --repo "$repo" --json number,url,headRefOid,baseRefName,files,statusCheckRollup \
--jq '{number,url,headRefOid,baseRefName,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '{head_sha,checks:[.check_runs[]|{name,status,conclusion,details_url}]}'
echo '=== Changed-file scope against develop ==='
git diff --name-status "develop...${sha}"
git diff --stat "develop...${sha}"
echo '=== Scoped diff ==='
git diff --no-ext-diff --unified=100 "develop...${sha}" -- \
apps/desktop/src/features/score/scoreStorage.ts \
apps/desktop/src/features/score/scoreStorage.test.ts \
package-lock.json
echo '=== Relevant file outlines ==='
ast-grep outline apps/desktop/src/features/score/scoreStorage.ts --items all
ast-grep outline apps/desktop/src/features/score/scoreStorage.test.ts --items all
echo '=== Nested lockfiles ==='
fd -HI '(^|/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' . \
-E .git -E node_modules | sort
echo '=== Lockfile undici dependency context ==='
rg -n -C 5 '"node_modules/undici"|"undici":' package-lock.jsonLength of output: 36079 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
sha='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
strix_job='91978764354'
coverage_job='91987916426'
echo '=== Strix annotations on the exact-head check ==='
gh api "repos/${repo}/check-runs/${strix_job}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,title,message,raw_details}'
echo '=== Strix failed-log excerpts ==='
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmpdir/strix.log"
rg -n -i -C 12 '::error|medium|projectId|songId|scoreId|finding|failed|failure|exit code' \
"$tmpdir/strix.log" | tail -n 320
echo '=== Coverage-evidence job steps and log excerpts ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{name,status,conclusion}]}'
gh api "repos/${repo}/actions/jobs/${coverage_job}/logs" > "$tmpdir/coverage.log"
rg -n -i -C 8 'scoreStorage|coverage|test|pass|fail|threshold' \
"$tmpdir/coverage.log" | tail -n 320
echo '=== Exact-head commit parents ==='
gh api "repos/${repo}/commits/${sha}" --jq '{sha,parents:[.parents[].sha]}'Length of output: 1845 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/bandscope'
strix_job='91978764354'
coverage_job='91987916426'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
echo '=== Strix job metadata ==='
gh api "repos/${repo}/actions/jobs/${strix_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Strix failed-log excerpts ==='
if gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmpdir/strix.log"; then
rg --allow-escape-sequences -n -i -C 12 \
'::error|medium|projectId|songId|scoreId|finding|failed|failure|exit code|strix' \
"$tmpdir/strix.log" | tail -n 400 || true
else
echo 'Could not download Strix logs.'
fi
echo '=== Coverage-evidence job metadata ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Coverage-evidence log excerpts ==='
if gh api "repos/${repo}/actions/jobs/${coverage_job}/logs" > "$tmpdir/coverage.log"; then
rg --allow-escape-sequences -n -i -C 8 \
'scoreStorage|coverage|test|pass|fail|threshold|materializ' \
"$tmpdir/coverage.log" | tail -n 400 || true
else
echo 'Could not download coverage-evidence logs.'
fiLength of output: 5735 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/bandscope'
coverage_run='30905262795'
coverage_job='91983961980'
ci_run='30905263479'
ci_job='91978765682'
echo '=== Exact-head coverage-source-tree job ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Exact-head build-and-test job ==='
gh api "repos/${repo}/actions/jobs/${ci_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== coverage-source-tree log excerpts ==='
gh run view "$coverage_run" --repo "$repo" --job "$coverage_job" --log 2>&1 \
| rg --allow-escape-sequences -n -i -C 6 \
'scoreStorage|coverage|test|pass|fail|threshold|materializ' \
| tail -n 300 || true
echo '=== build-and-test log excerpts ==='
gh run view "$ci_run" --repo "$repo" --job "$ci_job" --log 2>&1 \
| rg --allow-escape-sequences -n -i -C 6 \
'scoreStorage|vitest|test files|tests|passed|failed' \
| tail -n 300 || trueLength of output: 3550 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/bandscope'
ci_run='30905263479'
ci_job='91978765682'
echo '=== Candidate workflow files ==='
fd -HI -t f .github | sort
echo '=== quickcheck workflow definition ==='
rg -n -i -C 12 'quickcheck|build-and-test|vitest|scoreStorage' .github 2>/dev/null || true
echo '=== Text-only CI log excerpts ==='
gh run view "$ci_run" --repo "$repo" --job "$ci_job" --log 2>&1 \
| sed -E $'s/\x1B\\[[0-?]*[ -\\/]*[`@-`~]//g' \
| grep -a -i -E -C 6 'quickcheck|scoreStorage|vitest|test files|tests.*passed|tests.*failed' \
| tail -n 300 || trueLength of output: 17271
I found no blocking defect in the three changed files.
I cannot approve while the exact-head
|
|
@opencode-agent @cwl-noema-review Please perform a fresh exact-head review of |
|
@opencode-agent @cwl-noema-review Please independently re-review exact current head |
1 participant
What
Harden
readScorePdfso plain-array bridge responses are accepted only when every element is an integer in the inclusive0..255byte range. Validation uses an indexed, short-circuiting loop beforeUint8Array.from, preventing implicit wrapping, truncation, and non-finite coercion.The branch also retains the bounded root-lock update from Undici 7.28.0 to 7.29.0, which clears the current high-severity npm advisory set without adding a nested workspace lock.
Why
Uint8Array.fromsilently converts values such as-1,256,1.5,NaN, andInfinity. A malformed or compromised desktop bridge response must fail closed instead of being converted into different bytes. The indexed loop additionally avoids predicate callback overhead while preserving O(1) auxiliary validation memory and early termination.Verification contract
0and255are preserved;NaN, and infinity are rejected;Scope
Exactly three files differ from
develop:apps/desktop/src/features/score/scoreStorage.tsapps/desktop/src/features/score/scoreStorage.test.tspackage-lock.jsonNo workflow, permission, nested lockfile, proxy, runtime dependency, filesystem, network, or IPC authority is added.
Supersession
This clean review entry supersedes #729. Its exact clean head was retained, but the original pull request's workflows were left in GitHub's
action_requiredstate before any jobs could start. The replacement retriggers the same three-file tree through the normal current-head review and branch-protection path.