fix(score): validate PDF bridge byte arrays without coercion - #750
fix(score): validate PDF bridge byte arrays without coercion#750seonghobae wants to merge 17 commits into
Conversation
|
Warning Review limit reached
Next review available in: 6 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Comment |
|
@coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
|
@opencode-agent @cwl-noema-review Please independently review exact current head @coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
repo='ContextualWisdomLab/bandscope'
pr='750'
echo '=== Checked-out commit ==='
git rev-parse HEAD
echo '=== Expected commit object ==='
git rev-parse "${expected}^{commit}"
echo '=== PR metadata and current head ==='
gh pr view "$pr" --repo "$repo" --json number,url,headRefName,headRefOid,baseRefName,files,commits,statusCheckRollup \
--jq '{number,url,headRefName,headRefOid,baseRefName,files:[.files[].path],commits:[.commits[].oid],checks:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}]}'
echo '=== Changed-file names and stat against develop ==='
git diff --name-status develop..."$expected"
git diff --stat develop..."$expected"
echo '=== Full scoped diff ==='
git diff --no-ext-diff --unified=80 develop..."$expected" -- \
apps/desktop/src/features/score/scoreStorage.ts \
apps/desktop/src/features/score/scoreStorage.test.ts \
package-lock.json
echo '=== Relevant source outline ==='
ast-grep outline apps/desktop/src/features/score/scoreStorage.ts --items all
ast-grep outline apps/desktop/src/features/score/scoreStorage.test.ts --items all
echo '=== Nested lockfiles and workflow/authority changes ==='
fd -HI '(^|/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' . \
-E .git -E node_modules | sort
git diff --name-only develop..."$expected" | rg '(^|/)(\.github/workflows/|package-lock\.json$|npm-shrinkwrap\.json$|yarn\.lock$|pnpm-lock\.yaml$)' || true
echo '=== Undici entries in lockfile ==='
rg -n -C 3 '"node_modules/undici"|"undici":' package-lock.jsonLength of output: 26746 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
strix_run='30905262853'
strix_job='91978764354'
coverage_run='30905262795'
coverage_job='91983961980'
echo '=== Failed strix job metadata ==='
gh api "repos/${repo}/actions/jobs/${strix_job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion,number}]}'
echo '=== Failed strix job log tail ==='
gh run view "$strix_run" --repo "$repo" --job "$strix_job" --log-failed 2>&1 | tail -n 250
echo '=== Queued coverage job metadata ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion,number}]}'
echo '=== Latest PR check states ==='
gh pr view 750 --repo "$repo" --json headRefOid,statusCheckRollup \
--jq '{headRefOid,checks:[.statusCheckRollup[]|select(.name=="strix" or .name=="coverage-source-tree")|{name,status,conclusion,detailsUrl}]}'Length of output: 5019 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
strix_job='91978764354'
coverage_job='91983961980'
echo '=== Exact PR head and selected checks ==='
gh api "repos/${repo}/commits/74bb1fe30dc9c12e41e8ec015a64d084213d7b64/check-runs?per_page=100" \
--jq '{head_sha,check_runs:[.check_runs[]|select(.name=="strix" or .name=="coverage-source-tree")|{name,status,conclusion,details_url,started_at,completed_at,output}]}'
echo '=== Coverage job ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion}]}'
echo '=== Download and inspect Strix job log archive ==='
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmpdir/strix-logs.zip"
unzip -l "$tmpdir/strix-logs.zip"
unzip -p "$tmpdir/strix-logs.zip" | tail -n 300Length of output: 2958 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
check_run='91978764354'
echo '=== Strix check annotations ==='
gh api "repos/${repo}/check-runs/${check_run}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,title,message,raw_details}'
echo '=== Strix job-log endpoint response headers ==='
gh api -i "repos/${repo}/actions/jobs/${check_run}/logs" | sed -n '1,80p'Length of output: 6266 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
strix_job='91978764354'
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmp"
echo '=== Run Strix step and following output ==='
rg -n -A160 -i 'Run Strix \(quick\)|::error|error:|exception|traceback|failed|failure|exit code' "$tmp" \
| tail -n 400
echo '=== Final 180 log lines ==='
tail -n 180 "$tmp"Length of output: 67235
The three-file scope is correct. No workflow, permission, nested-lockfile, filesystem, network, or IPC authority change exists.
The root lockfile changes I cannot approve yet:
The successful build, test, audit, and other security checks are insufficient while these two conditions remain unresolved. ✅ Action performedReview finished.
|
|
@opencode-agent @cwl-noema-review Please independently review exact head |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head74bb1fe30dc9c12e41e8ec015a64d084213d7b64. -
Head SHA:
74bb1fe30dc9c12e41e8ec015a64d084213d7b64 -
Workflow run: 30981152078
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
|
|
@coderabbitai review Please review exact current head @opencode-agent Please rerun review for this exact head after the central npm-workspace coverage materializer is available; do not reuse the failed predecessor coverage-evidence result. @cwl-noema-review Please independently review this exact head. Merge remains subject to protected current-head checks and a qualifying non-author approval. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
sha='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
echo '=== Local and requested commit ==='
git rev-parse HEAD
git rev-parse "${sha}^{commit}"
echo '=== PR metadata and exact-head checks ==='
gh pr view 750 --repo "$repo" --json number,url,headRefOid,baseRefName,files,statusCheckRollup \
--jq '{number,url,headRefOid,baseRefName,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '{head_sha,checks:[.check_runs[]|{name,status,conclusion,details_url}]}'
echo '=== Changed-file scope against develop ==='
git diff --name-status "develop...${sha}"
git diff --stat "develop...${sha}"
echo '=== Scoped diff ==='
git diff --no-ext-diff --unified=100 "develop...${sha}" -- \
apps/desktop/src/features/score/scoreStorage.ts \
apps/desktop/src/features/score/scoreStorage.test.ts \
package-lock.json
echo '=== Relevant file outlines ==='
ast-grep outline apps/desktop/src/features/score/scoreStorage.ts --items all
ast-grep outline apps/desktop/src/features/score/scoreStorage.test.ts --items all
echo '=== Nested lockfiles ==='
fd -HI '(^|/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' . \
-E .git -E node_modules | sort
echo '=== Lockfile undici dependency context ==='
rg -n -C 5 '"node_modules/undici"|"undici":' package-lock.jsonLength of output: 36079 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
sha='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
strix_job='91978764354'
coverage_job='91987916426'
echo '=== Strix annotations on the exact-head check ==='
gh api "repos/${repo}/check-runs/${strix_job}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,title,message,raw_details}'
echo '=== Strix failed-log excerpts ==='
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmpdir/strix.log"
rg -n -i -C 12 '::error|medium|projectId|songId|scoreId|finding|failed|failure|exit code' \
"$tmpdir/strix.log" | tail -n 320
echo '=== Coverage-evidence job steps and log excerpts ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{name,status,conclusion}]}'
gh api "repos/${repo}/actions/jobs/${coverage_job}/logs" > "$tmpdir/coverage.log"
rg -n -i -C 8 'scoreStorage|coverage|test|pass|fail|threshold' \
"$tmpdir/coverage.log" | tail -n 320
echo '=== Exact-head commit parents ==='
gh api "repos/${repo}/commits/${sha}" --jq '{sha,parents:[.parents[].sha]}'Length of output: 1845 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/bandscope'
strix_job='91978764354'
coverage_job='91987916426'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
echo '=== Strix job metadata ==='
gh api "repos/${repo}/actions/jobs/${strix_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Strix failed-log excerpts ==='
if gh api "repos/${repo}/actions/jobs/${strix_job}/logs" > "$tmpdir/strix.log"; then
rg --allow-escape-sequences -n -i -C 12 \
'::error|medium|projectId|songId|scoreId|finding|failed|failure|exit code|strix' \
"$tmpdir/strix.log" | tail -n 400 || true
else
echo 'Could not download Strix logs.'
fi
echo '=== Coverage-evidence job metadata ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Coverage-evidence log excerpts ==='
if gh api "repos/${repo}/actions/jobs/${coverage_job}/logs" > "$tmpdir/coverage.log"; then
rg --allow-escape-sequences -n -i -C 8 \
'scoreStorage|coverage|test|pass|fail|threshold|materializ' \
"$tmpdir/coverage.log" | tail -n 400 || true
else
echo 'Could not download coverage-evidence logs.'
fiLength of output: 5735 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/bandscope'
coverage_run='30905262795'
coverage_job='91983961980'
ci_run='30905263479'
ci_job='91978765682'
echo '=== Exact-head coverage-source-tree job ==='
gh api "repos/${repo}/actions/jobs/${coverage_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Exact-head build-and-test job ==='
gh api "repos/${repo}/actions/jobs/${ci_job}" \
--jq '{name,status,conclusion,started_at,completed_at,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== coverage-source-tree log excerpts ==='
gh run view "$coverage_run" --repo "$repo" --job "$coverage_job" --log 2>&1 \
| rg --allow-escape-sequences -n -i -C 6 \
'scoreStorage|coverage|test|pass|fail|threshold|materializ' \
| tail -n 300 || true
echo '=== build-and-test log excerpts ==='
gh run view "$ci_run" --repo "$repo" --job "$ci_job" --log 2>&1 \
| rg --allow-escape-sequences -n -i -C 6 \
'scoreStorage|vitest|test files|tests|passed|failed' \
| tail -n 300 || trueLength of output: 3550 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/bandscope'
ci_run='30905263479'
ci_job='91978765682'
echo '=== Candidate workflow files ==='
fd -HI -t f .github | sort
echo '=== quickcheck workflow definition ==='
rg -n -i -C 12 'quickcheck|build-and-test|vitest|scoreStorage' .github 2>/dev/null || true
echo '=== Text-only CI log excerpts ==='
gh run view "$ci_run" --repo "$repo" --job "$ci_job" --log 2>&1 \
| sed -E $'s/\x1B\\[[0-?]*[ -\\/]*[`@-`~]//g' \
| grep -a -i -E -C 6 'quickcheck|scoreStorage|vitest|test files|tests.*passed|tests.*failed' \
| tail -n 300 || trueLength of output: 17271
I found no blocking defect in the three changed files.
I cannot approve while the exact-head
|
|
@opencode-agent @cwl-noema-review Please perform a fresh exact-head review of |
|
@opencode-agent @cwl-noema-review Please independently re-review exact current head |
|
@coderabbitai review Please review the exact live head only. Verify PDF bridge arrays accept only integers 0..255 before Uint8Array construction, reject strings/negative/out-of-range/fractional/NaN/infinite values, short-circuit after the first invalid element, preserve valid boundary bytes and bridge-unavailable fail-closed behavior, and retain the bounded root-lock Undici update without nested locks. Require current desktop lint, strict typecheck, complete measured tests and coverage, production build, npm audit, security gates, and zero unresolved threads. Review only; do not update the branch, merge, release, or alter protections. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
pr='750'
echo '=== Pull request live head, changed files, and checks ==='
gh pr view "$pr" --repo "$repo" \
--json number,url,headRefOid,baseRefName,files,statusCheckRollup,reviews \
--jq '{
number,url,headRefOid,baseRefName,
files:[.files[].path],
checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}],
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]
}'
sha="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
echo "=== Live SHA: ${sha} ==="
git rev-parse HEAD
git rev-parse "${sha}^{commit}"
echo '=== Diff scope against develop ==='
git diff --name-status "develop...${sha}"
git diff --stat "develop...${sha}"
echo '=== Changed source and test diff ==='
git diff --no-ext-diff --unified=100 "develop...${sha}" -- \
apps/desktop/src/features/score/scoreStorage.ts \
apps/desktop/src/features/score/scoreStorage.test.ts
echo '=== Lockfile diff and Undici context ==='
git diff --no-ext-diff --unified=25 "develop...${sha}" -- package-lock.json
rg -n -C 4 '"node_modules/undici"|"undici":' package-lock.json
echo '=== Changed-file outlines ==='
ast-grep outline apps/desktop/src/features/score/scoreStorage.ts --items all
ast-grep outline apps/desktop/src/features/score/scoreStorage.test.ts --items all
echo '=== Lockfiles in repository ==='
fd -HI '(^|/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml)$' . \
-E .git -E node_modules | sort
echo '=== Open review-thread count ==='
gh api graphql -F owner='ContextualWisdomLab' -F name='bandscope' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
echo '=== Exact-head check runs ==='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
--jq '{head_sha,checks:[.check_runs[]|{name,status,conclusion,details_url}]}'Length of output: 31722 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/bandscope'
pr='750'
sha='74bb1fe30dc9c12e41e8ec015a64d084213d7b64'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
echo '=== Pull request reviews and review comments ==='
gh pr view "$pr" --repo "$repo" --json reviews,comments \
--jq '{
reviews:[.reviews[]|{author:.author.login,state,body,submittedAt,commit:.commit.oid}],
comments:[.comments[]|{author:.author.login,body,createdAt}]
}'
echo '=== Strix annotations and job steps ==='
gh api "repos/${repo}/check-runs/91978764354/annotations?per_page=100" \
--jq '.[]|{path,start_line,end_line,annotation_level,title,message,raw_details}'
gh api "repos/${repo}/actions/jobs/91978764354" \
--jq '{name,status,conclusion,steps:[.steps[]|{number,name,status,conclusion}]}'
echo '=== Strix failure excerpts ==='
gh api "repos/${repo}/actions/jobs/91978764354/logs" > "$tmpdir/strix.log"
rg --text -n -i -C 10 \
'::error|error:|warning:|medium|high|critical|finding|projectId|songId|scoreId|exit code|failed|failure' \
"$tmpdir/strix.log" | tail -n 350 || true
for job in \
91978765682 \
91983961980 \
91987916426 \
91978766074 \
91978765893 \
91978765874 \
91978765928 \
91978765827 \
91978765562
do
echo "=== Job ${job}: metadata ==="
gh api "repos/${repo}/actions/jobs/${job}" \
--jq '{name,status,conclusion,steps:[.steps[]|{number,name,status,conclusion}]}'
gh api "repos/${repo}/actions/jobs/${job}/logs" > "$tmpdir/${job}.log"
echo "=== Job ${job}: relevant log lines ==="
rg --text -n -i -C 4 \
'lint|typecheck|type check|vitest|test files|tests.*pass|coverage|scoreStorage|build|audit|vulnerabilit|npm error|fail|error' \
"$tmpdir/${job}.log" | tail -n 180 || true
doneLength of output: 34151 🏁 Script executed: #!/bin/bash
set -u -o pipefail
repo='ContextualWisdomLab/bandscope'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
fetch_log() {
local job="$1"
gh api "repos/${repo}/actions/jobs/${job}/logs" > "${tmpdir}/${job}.raw" || return 0
sed -E $'s/\x1B\\[[0-?]*[ -\\/]*[`@-`~]//g' "${tmpdir}/${job}.raw" > "${tmpdir}/${job}.log"
}
echo '=== Strix failed step output ==='
fetch_log '91978764354'
grep -a -i -E -C 12 \
'Run Strix \(quick\)|projectId|songId|scoreId|finding|medium|high|critical|error|failed|exit code' \
"${tmpdir}/91978764354.log" | tail -n 450 || true
for job in 91978765682 91983961980 91987916426 91978766074 91978765562; do
echo "=== Job ${job}: status and relevant evidence ==="
gh api "repos/${repo}/actions/jobs/${job}" \
--jq '{name,status,conclusion,steps:[.steps[]|{name,conclusion}]}' || true
fetch_log "$job"
grep -a -i -E -C 5 \
'lint|typecheck|type check|vitest|test files|tests.*passed|coverage|scoreStorage|production build|build complete|npm audit|vulnerabilit|found 0|fail|error' \
"${tmpdir}/${job}.log" | tail -n 260 || true
doneLength of output: 6127
I found no blocking defect in the three changed files.
I cannot approve this head.
Resolve or formally accept the failed
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
The byte-validation implementation and short-circuit regression are appropriately fail-closed. Before the current-head review rerun, remove the unrelated package-lock.json change because dedicated PR #751 owns the Undici security update, and add an Unreleased CHANGELOG entry describing the bridge-byte validation. This should finish as a focused three-file product slice: production code, direct tests, and CHANGELOG. Rerun exact-head desktop lint, strict typecheck, measured tests, build, repository CI/security, and central evidence after the central validator repair; predecessor-head results are not transferable.
|
@opencode-agent address Clean exact current head Keep the verified Run desktop lint, strict typecheck, complete measured tests, production build, and repository quickcheck before committing normally to this branch. Do not create another branch, PR, workflow, helper, patch artifact, dependency update, or unrelated refactor. Fresh central current-head review is required after the central npm-lock validator repair. |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3e4b88a664bec74074b615e2f410f8ef192fcaae. -
Head SHA:
3e4b88a664bec74074b615e2f410f8ef192fcaae -
Workflow run: 31193392189
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
1 participant
What
Harden
readScorePdfso plain-array bridge responses are accepted only when every element is an integer in the inclusive0..255byte range. Validation uses an indexed, short-circuiting loop beforeUint8Array.from, preventing implicit wrapping, truncation, and non-finite coercion.Why
Uint8Array.fromsilently converts values such as-1,256,1.5,NaN, andInfinity. A malformed or compromised desktop bridge response must fail closed instead of being converted into different bytes. The indexed loop additionally avoids predicate callback overhead while preserving O(1) auxiliary validation memory and early termination.Exact current scope
Exact head:
3e4b88a664bec74074b615e2f410f8ef192fcaae.Exactly three files differ from protected
develop:apps/desktop/src/features/score/scoreStorage.tsapps/desktop/src/features/score/scoreStorage.test.tsCHANGELOG.mdThe unrelated Undici lock update was removed; dependency security remains owned by PR #751. No workflow, permission, dependency, nested lockfile, proxy, filesystem authority, network authority, or IPC command is added.
Verification contract
0and255are preserved;NaN, and infinity are rejected;CHANGELOG.mdUnreleased;Supersession
This clean review entry supersedes #729. No predecessor-head check or review is accepted for the current exact head.