From 21646fa4510a3a99cd26d5f2a05acad3efc46514 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 09:58:53 +0200 Subject: [PATCH 01/35] test: cover validated CodeQL regressions --- .../codeql-real-findings-regressions.test.ts | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 tests/codeql-real-findings-regressions.test.ts diff --git a/tests/codeql-real-findings-regressions.test.ts b/tests/codeql-real-findings-regressions.test.ts new file mode 100644 index 0000000000..ddab4beb89 --- /dev/null +++ b/tests/codeql-real-findings-regressions.test.ts @@ -0,0 +1,47 @@ +import { describe, expect, test } from "bun:test"; +import { readFileSync } from "node:fs"; +import { join } from "node:path"; +import { parseTomlDocument } from "../src/codex/project-config-warnings"; + +const issueQuality = require("../.github/scripts/issue-quality.cjs") as { + clean: (value: unknown) => string; +}; +const prQuality = require("../.github/scripts/pr-quality.cjs") as { + assessPrDescription: (body: string) => { ok: boolean; reason?: string }; + hasScreenshotEvidence: (body: string) => boolean; +}; + +describe("validated CodeQL regressions", () => { + test("unterminated HTML comments stay non-rendered through EOF", () => { + const hiddenScreenshot = "\nVisible text")).toBe("Visible text"); + }); + + test("malformed TOML basic strings are ignored while escaped strings still parse", () => { + const malformed = parseTomlDocument('model_provider = "' + "\\".repeat(64)); + expect(malformed.root.model_provider).toBeUndefined(); + + const valid = parseTomlDocument('model_provider = "provider\\\\name"'); + expect(valid.root.model_provider).toBe("provider\\name"); + }); + + test("TOML string matchers do not let backslash enter both repetition arms", () => { + const unsafe = '"(?:\\\\.|[^"])*"'; + const safe = '"(?:\\\\.|[^"\\\\])*"'; + const files = [ + "src/codex/project-config-warnings.ts", + "src/codex/inject.ts", + "src/codex/plugins-doctor.ts", + ]; + + for (const path of files) { + const source = readFileSync(join(process.cwd(), path), "utf8"); + expect(source).not.toContain(unsafe); + expect(source).toContain(safe); + } + }); +}); From a8684b37b50046b9f139bea5ca6dfd5bee5f4603 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:00:11 +0200 Subject: [PATCH 02/35] fix: harden project TOML parsing --- src/codex/project-config-warnings.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/codex/project-config-warnings.ts b/src/codex/project-config-warnings.ts index ba5a2f268b..a528f32d92 100644 --- a/src/codex/project-config-warnings.ts +++ b/src/codex/project-config-warnings.ts @@ -70,7 +70,7 @@ export function parseTomlDocument(content: string): TomlDocument { current = section; continue; } - const kv = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*("(?:\\.|[^"])*"|'[^']*'|[^\s#]+)\s*(?:#.*)?$/); + const kv = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|[^\s#]+)\s*(?:#.*)?$/); if (kv) current[kv[1]!] = parseTomlString(kv[2]!); } @@ -422,4 +422,4 @@ export function printProjectCodexConfigWarnings( } } return warnings; -} +} \ No newline at end of file From eba159128b95a90f714c9878844735cb27608013 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:00:42 +0200 Subject: [PATCH 03/35] fix: harden plugin TOML parsing --- src/codex/plugins-doctor.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/codex/plugins-doctor.ts b/src/codex/plugins-doctor.ts index db6657f927..1465266bfa 100644 --- a/src/codex/plugins-doctor.ts +++ b/src/codex/plugins-doctor.ts @@ -59,7 +59,7 @@ function readMarketplaceTable(configText: string, name: string): Record Date: Sat, 15 Aug 2026 10:01:32 +0200 Subject: [PATCH 04/35] fix: reject hidden PR comment content --- .github/scripts/pr-quality.cjs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/scripts/pr-quality.cjs b/.github/scripts/pr-quality.cjs index f531e511d9..b36283de2e 100644 --- a/.github/scripts/pr-quality.cjs +++ b/.github/scripts/pr-quality.cjs @@ -58,8 +58,8 @@ const PR_TEMPLATE_BOILERPLATE_LINES = new Set([ /** Case-insensitive whole-word match for the GUI surface (repo convention: `gui/`). */ const GUI_CUE_RE = /\bgui\b/i; -/** HTML comments, which GitHub never renders. */ -const HTML_COMMENT_RE = //g; +/** HTML comments, which GitHub never renders. An unclosed comment runs through EOF. */ +const HTML_COMMENT_RE = /|$)/g; /** Fenced code blocks (``` or ~~~) whose content GitHub does not render. */ const FENCED_CODE_RE = /(?:^|\n)[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?^[ \t]*\1[ \t]*(?=\n|$)/gm; /** Embedded markdown image (`![alt](url)`), as GitHub renders for dropped images. */ @@ -147,7 +147,7 @@ function assessPrDescription(body) { const withoutTemplate = stripPrTemplateBoilerplate(withoutReadiness); const cleaned = clean(withoutTemplate); if (!cleaned) { - const strippedComments = withoutTemplate.replace(//g, "").trim(); + const strippedComments = withoutTemplate.replace(HTML_COMMENT_RE, "").trim(); if (!strippedComments) return { ok: false, reason: "empty" }; if (isPlaceholderOnlyValue(strippedComments)) { return { ok: false, reason: "placeholder" }; @@ -551,4 +551,4 @@ module.exports = { collectPrQualityFailures, hasEscapedNewlines, stripPrTemplateBoilerplate, -}; +}; \ No newline at end of file From 2607eb27aeba07e29d4bf2c4e16866ee7e3f13d1 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:04:32 +0200 Subject: [PATCH 05/35] ci: run temporary CodeQL repair verification --- .github/workflows/tmp-codeql-repair.yml | 92 +++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 .github/workflows/tmp-codeql-repair.yml diff --git a/.github/workflows/tmp-codeql-repair.yml b/.github/workflows/tmp-codeql-repair.yml new file mode 100644 index 0000000000..988b67d528 --- /dev/null +++ b/.github/workflows/tmp-codeql-repair.yml @@ -0,0 +1,92 @@ +name: Temporary CodeQL repair verification + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: write + +jobs: + repair-and-verify: + if: github.actor != 'github-actions[bot]' + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Apply remaining validated CodeQL fixes + shell: python + run: | + from pathlib import Path + + replacements = [ + ( + Path("src/codex/inject.ts"), + r'"(?:\\.|[^"])*"', + r'"(?:\\.|[^"\\])*"', + 3, + ), + ( + Path(".github/scripts/issue-quality-core.cjs"), + r'//g', + r'/|$)/g', + 3, + ), + ] + + for path, old, new, expected in replacements: + text = path.read_text(encoding="utf-8") + actual = text.count(old) + if actual != expected: + raise SystemExit(f"{path}: expected {expected} vulnerable matches, found {actual}") + path.write_text(text.replace(old, new), encoding="utf-8") + + unsafe = r'"(?:\\.|[^"])*"' + safe = r'"(?:\\.|[^"\\])*"' + for name in ( + "src/codex/project-config-warnings.ts", + "src/codex/inject.ts", + "src/codex/plugins-doctor.ts", + ): + text = Path(name).read_text(encoding="utf-8") + if unsafe in text: + raise SystemExit(f"{name}: unsafe TOML matcher remains") + if safe not in text: + raise SystemExit(f"{name}: safe TOML matcher missing") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run focused regressions + run: >- + bun test + tests/codeql-real-findings-regressions.test.ts + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit verified source changes + shell: bash + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add src/codex/inject.ts .github/scripts/issue-quality-core.cjs + git diff --cached --quiet && exit 0 + git commit -m "fix: close validated CodeQL findings [codeql-patch-applied]" + git push origin HEAD:agent/codeql-real-findings-20260815 From cb1b0a1d77b88d133201498567cb9f1738a0c767 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:05:23 +0200 Subject: [PATCH 06/35] test: assert bounded TOML matcher execution --- tests/codeql-real-findings-regressions.test.ts | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/tests/codeql-real-findings-regressions.test.ts b/tests/codeql-real-findings-regressions.test.ts index ddab4beb89..25caeabcdd 100644 --- a/tests/codeql-real-findings-regressions.test.ts +++ b/tests/codeql-real-findings-regressions.test.ts @@ -21,9 +21,12 @@ describe("validated CodeQL regressions", () => { expect(issueQuality.clean("\nVisible text")).toBe("Visible text"); }); - test("malformed TOML basic strings are ignored while escaped strings still parse", () => { - const malformed = parseTomlDocument('model_provider = "' + "\\".repeat(64)); - expect(malformed.root.model_provider).toBeUndefined(); + test("malformed TOML basic strings stay bounded while escaped strings still parse", () => { + const started = performance.now(); + const malformed = parseTomlDocument('model_provider = "' + "\\".repeat(40)); + const elapsedMs = performance.now() - started; + expect(elapsedMs).toBeLessThan(100); + expect(typeof malformed.root.model_provider).toBe("string"); const valid = parseTomlDocument('model_provider = "provider\\\\name"'); expect(valid.root.model_provider).toBe("provider\\name"); @@ -44,4 +47,4 @@ describe("validated CodeQL regressions", () => { expect(source).toContain(safe); } }); -}); +}); \ No newline at end of file From 98405c9a1ae2495b86d7e4909003b4f27152b06d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 08:05:43 +0000 Subject: [PATCH 07/35] fix: close validated CodeQL findings [codeql-patch-applied] --- .github/scripts/issue-quality-core.cjs | 6 +++--- src/codex/inject.ts | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/scripts/issue-quality-core.cjs b/.github/scripts/issue-quality-core.cjs index 40fadaca6d..cd8bf0bce7 100644 --- a/.github/scripts/issue-quality-core.cjs +++ b/.github/scripts/issue-quality-core.cjs @@ -31,7 +31,7 @@ function unwrapSingleEnclosingFence(text) { */ function normalizeRawSectionValue(raw) { if (typeof raw !== "string") return null; - let value = raw.replace(//g, "").trim(); + let value = raw.replace(/|$)/g, "").trim(); if (!value) return null; // A lone fenced block whose entire body is a stand-in is still a stand-in @@ -179,7 +179,7 @@ function stripHtmlMedia(text) { if (typeof text !== "string") return ""; let s = text .replace(/]*>/gi, " ") - .replace(//g, " "); + .replace(/|$)/g, " "); // Whole media blocks: replace only when the inner content is not // substantive text (no word characters outside tags). @@ -424,7 +424,7 @@ function isMediaOnly(text) { */ function clean(raw) { if (typeof raw !== "string") return ""; - let s = raw.replace(//g, ""); + let s = raw.replace(/|$)/g, ""); // Media-only sections (a lone screenshot or embed) carry no reportable // text. Strip the media tokens so the section participates in emptiness and // duplicate detection like any other blank section. This closes the diff --git a/src/codex/inject.ts b/src/codex/inject.ts index 7d5b516abe..0a02e3dd10 100644 --- a/src/codex/inject.ts +++ b/src/codex/inject.ts @@ -449,7 +449,7 @@ function stripRootRoutedModel(content: string): string { .filter((line, i) => { const isRoot = firstTable === -1 || i < firstTable; if (!isRoot) return true; - const m = line.match(/^\s*model\s*=\s*("(?:\\.|[^"])*"|'[^']*')\s*$/); + const m = line.match(/^\s*model\s*=\s*("(?:\\.|[^"\\])*"|'[^']*')\s*$/); if (!m) return true; const model = parseTomlString(m[1]); return !model?.includes("/"); @@ -485,7 +485,7 @@ function setRootModelCatalogPath(content: string, catalogPath: string): string { const rootEnd = firstTable === -1 ? lines.length : firstTable; for (let i = 0; i < rootEnd; i++) { const m = lines[i].match( - /^\s*model_catalog_json\s*=\s*("(?:\\.|[^"])*"|'[^']*')\s*$/, + /^\s*model_catalog_json\s*=\s*("(?:\\.|[^"\\])*"|'[^']*')\s*$/, ); if (!m) continue; const existing = parseTomlString(m[1]); @@ -580,7 +580,7 @@ function stripOpencodexCatalogPath(content: string): string { .split("\n") .filter((line) => { const m = line.match( - /^\s*model_catalog_json\s*=\s*("(?:\\.|[^"])*"|'[^']*')\s*$/, + /^\s*model_catalog_json\s*=\s*("(?:\\.|[^"\\])*"|'[^']*')\s*$/, ); return !m || !isOpencodexCatalogPath(parseTomlString(m[1])); }) From 69ff030e7befffdb7560728b6a06e028b83b68e0 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:05:50 +0200 Subject: [PATCH 08/35] ci: rerun CodeQL repair verification --- .github/workflows/tmp-codeql-repair.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/tmp-codeql-repair.yml b/.github/workflows/tmp-codeql-repair.yml index 988b67d528..b4d532c55b 100644 --- a/.github/workflows/tmp-codeql-repair.yml +++ b/.github/workflows/tmp-codeql-repair.yml @@ -10,6 +10,7 @@ permissions: jobs: repair-and-verify: + # Re-run after correcting the regression assertion; the source patch is still exact-count gated. if: github.actor != 'github-actions[bot]' runs-on: ubuntu-latest timeout-minutes: 20 From 35feb7d53d755848c4425254a7e88e9bf67e8f37 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:06:23 +0200 Subject: [PATCH 09/35] ci: remove temporary CodeQL repair workflow --- .github/workflows/tmp-codeql-repair.yml | 93 ------------------------- 1 file changed, 93 deletions(-) delete mode 100644 .github/workflows/tmp-codeql-repair.yml diff --git a/.github/workflows/tmp-codeql-repair.yml b/.github/workflows/tmp-codeql-repair.yml deleted file mode 100644 index b4d532c55b..0000000000 --- a/.github/workflows/tmp-codeql-repair.yml +++ /dev/null @@ -1,93 +0,0 @@ -name: Temporary CodeQL repair verification - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: write - -jobs: - repair-and-verify: - # Re-run after correcting the regression assertion; the source patch is still exact-count gated. - if: github.actor != 'github-actions[bot]' - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Apply remaining validated CodeQL fixes - shell: python - run: | - from pathlib import Path - - replacements = [ - ( - Path("src/codex/inject.ts"), - r'"(?:\\.|[^"])*"', - r'"(?:\\.|[^"\\])*"', - 3, - ), - ( - Path(".github/scripts/issue-quality-core.cjs"), - r'//g', - r'/|$)/g', - 3, - ), - ] - - for path, old, new, expected in replacements: - text = path.read_text(encoding="utf-8") - actual = text.count(old) - if actual != expected: - raise SystemExit(f"{path}: expected {expected} vulnerable matches, found {actual}") - path.write_text(text.replace(old, new), encoding="utf-8") - - unsafe = r'"(?:\\.|[^"])*"' - safe = r'"(?:\\.|[^"\\])*"' - for name in ( - "src/codex/project-config-warnings.ts", - "src/codex/inject.ts", - "src/codex/plugins-doctor.ts", - ): - text = Path(name).read_text(encoding="utf-8") - if unsafe in text: - raise SystemExit(f"{name}: unsafe TOML matcher remains") - if safe not in text: - raise SystemExit(f"{name}: safe TOML matcher missing") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run focused regressions - run: >- - bun test - tests/codeql-real-findings-regressions.test.ts - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit verified source changes - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add src/codex/inject.ts .github/scripts/issue-quality-core.cjs - git diff --cached --quiet && exit 0 - git commit -m "fix: close validated CodeQL findings [codeql-patch-applied]" - git push origin HEAD:agent/codeql-real-findings-20260815 From 2a16a6c211d9a3713199370b6415a42f3d3f96f8 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:07:33 +0200 Subject: [PATCH 10/35] test: cover release-note comment handling --- tests/codeql-real-findings-regressions.test.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/codeql-real-findings-regressions.test.ts b/tests/codeql-real-findings-regressions.test.ts index 25caeabcdd..feb6000151 100644 --- a/tests/codeql-real-findings-regressions.test.ts +++ b/tests/codeql-real-findings-regressions.test.ts @@ -1,6 +1,7 @@ import { describe, expect, test } from "bun:test"; import { readFileSync } from "node:fs"; import { join } from "node:path"; +import { hasMeaningfulCarriedNotes } from "../scripts/release-notes"; import { parseTomlDocument } from "../src/codex/project-config-warnings"; const issueQuality = require("../.github/scripts/issue-quality.cjs") as { @@ -21,6 +22,12 @@ describe("validated CodeQL regressions", () => { expect(issueQuality.clean("\nVisible text")).toBe("Visible text"); }); + test("release-note comments stay non-meaningful through a closing marker or EOF", () => { + expect(hasMeaningfulCarriedNotes("")).toBe(false); + expect(hasMeaningfulCarriedNotes("\n## What's Changed\n* visible fix")).toBe(true); + }); + test("malformed TOML basic strings stay bounded while escaped strings still parse", () => { const started = performance.now(); const malformed = parseTomlDocument('model_provider = "' + "\\".repeat(40)); From 31c762ca902b8097185d8202f13795d947372f5f Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:07:51 +0200 Subject: [PATCH 11/35] ci: verify final CodeQL release-note fix --- .../workflows/tmp-codeql-release-notes.yml | 70 +++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .github/workflows/tmp-codeql-release-notes.yml diff --git a/.github/workflows/tmp-codeql-release-notes.yml b/.github/workflows/tmp-codeql-release-notes.yml new file mode 100644 index 0000000000..d391bc3a82 --- /dev/null +++ b/.github/workflows/tmp-codeql-release-notes.yml @@ -0,0 +1,70 @@ +name: Temporary CodeQL release-note verification + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: write + +jobs: + repair-and-verify: + if: github.actor != 'github-actions[bot]' + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Apply validated release-note fix + shell: python + run: | + from pathlib import Path + + path = Path("scripts/release-notes.ts") + text = path.read_text(encoding="utf-8") + old = ''' const withoutComment = body + .replace(/\\r\\n/g, "\\n") + .split("\\n") + .filter(line => !/^$/.test(line.trim())) + .filter(line => !/^\\*\\*Full Changelog\\*\\*:/.test(line)) + .join("\\n");''' + new = ''' const withoutComment = body + .replace(/\\r\\n/g, "\\n") + .replace(/|$)/g, "") + .split("\\n") + .filter(line => !/^\\*\\*Full Changelog\\*\\*:/.test(line)) + .join("\\n");''' + actual = text.count(old) + if actual != 1: + raise SystemExit(f"expected one release-note comment block, found {actual}") + path.write_text(text.replace(old, new), encoding="utf-8") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run release-note and CodeQL regressions + run: bun test tests/codeql-real-findings-regressions.test.ts tests/release-notes.test.ts + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit verified release-note source change + shell: bash + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add scripts/release-notes.ts + git diff --cached --quiet && exit 0 + git commit -m "fix: ignore non-rendered release-note comments [codeql-patch-applied]" + git push origin HEAD:agent/codeql-real-findings-20260815 From 29e3c3f041592edc286c881d2d24b1068aaa4f20 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:09:29 +0200 Subject: [PATCH 12/35] ci: correct release-note repair matcher --- .../workflows/tmp-codeql-release-notes.yml | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/.github/workflows/tmp-codeql-release-notes.yml b/.github/workflows/tmp-codeql-release-notes.yml index d391bc3a82..6606c2169c 100644 --- a/.github/workflows/tmp-codeql-release-notes.yml +++ b/.github/workflows/tmp-codeql-release-notes.yml @@ -29,18 +29,16 @@ jobs: path = Path("scripts/release-notes.ts") text = path.read_text(encoding="utf-8") - old = ''' const withoutComment = body - .replace(/\\r\\n/g, "\\n") - .split("\\n") - .filter(line => !/^$/.test(line.trim())) - .filter(line => !/^\\*\\*Full Changelog\\*\\*:/.test(line)) - .join("\\n");''' - new = ''' const withoutComment = body - .replace(/\\r\\n/g, "\\n") - .replace(/|$)/g, "") - .split("\\n") - .filter(line => !/^\\*\\*Full Changelog\\*\\*:/.test(line)) - .join("\\n");''' + old = ( + r' .replace(/\r\n/g, "\n")' + "\n" + + r' .split("\n")' + "\n" + + r' .filter(line => !/^$/.test(line.trim()))' + ) + new = ( + r' .replace(/\r\n/g, "\n")' + "\n" + + r' .replace(/|$)/g, "")' + "\n" + + r' .split("\n")' + ) actual = text.count(old) if actual != 1: raise SystemExit(f"expected one release-note comment block, found {actual}") From adcd875f9e7ddf5dcac6b670e8cc1937ac1be747 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 08:09:46 +0000 Subject: [PATCH 13/35] fix: ignore non-rendered release-note comments [codeql-patch-applied] --- scripts/release-notes.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/release-notes.ts b/scripts/release-notes.ts index 98aa308731..1508fe7167 100644 --- a/scripts/release-notes.ts +++ b/scripts/release-notes.ts @@ -161,8 +161,8 @@ export function stripCarriedReleaseNotes(body: string): string { export function isEmptyGeneratedNotes(body: string): boolean { const withoutComment = body .replace(/\r\n/g, "\n") + .replace(/|$)/g, "") .split("\n") - .filter(line => !/^$/.test(line.trim())) .filter(line => !/^\*\*Full Changelog\*\*:/.test(line)) .join("\n"); return !hasNonWhitespace(withoutComment); From 4de66bea6d91aa12a19c01053738ddb379456447 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:10:05 +0200 Subject: [PATCH 14/35] ci: remove temporary release-note verifier --- .../workflows/tmp-codeql-release-notes.yml | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 .github/workflows/tmp-codeql-release-notes.yml diff --git a/.github/workflows/tmp-codeql-release-notes.yml b/.github/workflows/tmp-codeql-release-notes.yml deleted file mode 100644 index 6606c2169c..0000000000 --- a/.github/workflows/tmp-codeql-release-notes.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Temporary CodeQL release-note verification - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: write - -jobs: - repair-and-verify: - if: github.actor != 'github-actions[bot]' - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Apply validated release-note fix - shell: python - run: | - from pathlib import Path - - path = Path("scripts/release-notes.ts") - text = path.read_text(encoding="utf-8") - old = ( - r' .replace(/\r\n/g, "\n")' + "\n" - + r' .split("\n")' + "\n" - + r' .filter(line => !/^$/.test(line.trim()))' - ) - new = ( - r' .replace(/\r\n/g, "\n")' + "\n" - + r' .replace(/|$)/g, "")' + "\n" - + r' .split("\n")' - ) - actual = text.count(old) - if actual != 1: - raise SystemExit(f"expected one release-note comment block, found {actual}") - path.write_text(text.replace(old, new), encoding="utf-8") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run release-note and CodeQL regressions - run: bun test tests/codeql-real-findings-regressions.test.ts tests/release-notes.test.ts - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit verified release-note source change - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add scripts/release-notes.ts - git diff --cached --quiet && exit 0 - git commit -m "fix: ignore non-rendered release-note comments [codeql-patch-applied]" - git push origin HEAD:agent/codeql-real-findings-20260815 From 532d8ada4403de260cb873a0d4210201ea2ee487 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:10:34 +0200 Subject: [PATCH 15/35] ci: run final CodeQL fix verification --- .github/workflows/tmp-codeql-final-verify.yml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/tmp-codeql-final-verify.yml diff --git a/.github/workflows/tmp-codeql-final-verify.yml b/.github/workflows/tmp-codeql-final-verify.yml new file mode 100644 index 0000000000..a8584117a4 --- /dev/null +++ b/.github/workflows/tmp-codeql-final-verify.yml @@ -0,0 +1,46 @@ +name: Temporary CodeQL final verification + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run focused Bun suites + run: >- + bun test + tests/codeql-real-findings-regressions.test.ts + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + tests/release-notes.test.ts + + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Lint + run: bun run lint + + - name: Check branch diff + run: git diff --check origin/dev...HEAD From 1ff1b907a42f67216a1c4f542d3b98a8c402f358 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:11:17 +0200 Subject: [PATCH 16/35] ci: rerun final CodeQL verification without missing lint script --- .github/workflows/tmp-codeql-final-verify.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/tmp-codeql-final-verify.yml b/.github/workflows/tmp-codeql-final-verify.yml index a8584117a4..bbbf51950b 100644 --- a/.github/workflows/tmp-codeql-final-verify.yml +++ b/.github/workflows/tmp-codeql-final-verify.yml @@ -39,8 +39,5 @@ jobs: - name: Typecheck run: bun run typecheck - - name: Lint - run: bun run lint - - name: Check branch diff run: git diff --check origin/dev...HEAD From 07f166bfebbe8c9284d8c099afb80aa60a0ee051 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:11:54 +0200 Subject: [PATCH 17/35] ci: remove temporary CodeQL final verifier --- .github/workflows/tmp-codeql-final-verify.yml | 43 ------------------- 1 file changed, 43 deletions(-) delete mode 100644 .github/workflows/tmp-codeql-final-verify.yml diff --git a/.github/workflows/tmp-codeql-final-verify.yml b/.github/workflows/tmp-codeql-final-verify.yml deleted file mode 100644 index bbbf51950b..0000000000 --- a/.github/workflows/tmp-codeql-final-verify.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Temporary CodeQL final verification - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: read - -jobs: - verify: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run focused Bun suites - run: >- - bun test - tests/codeql-real-findings-regressions.test.ts - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - tests/release-notes.test.ts - - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check branch diff - run: git diff --check origin/dev...HEAD From ca7eadde099960f6db9de60f74b887de0fb96c9b Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:26:13 +0200 Subject: [PATCH 18/35] ci: relocate CodeQL regressions into owner suites --- .../workflows/tmp-relocate-codeql-tests.yml | 202 ++++++++++++++++++ 1 file changed, 202 insertions(+) create mode 100644 .github/workflows/tmp-relocate-codeql-tests.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests.yml b/.github/workflows/tmp-relocate-codeql-tests.yml new file mode 100644 index 0000000000..4598604aa4 --- /dev/null +++ b/.github/workflows/tmp-relocate-codeql-tests.yml @@ -0,0 +1,202 @@ +name: Temporary relocate CodeQL regressions + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: write + +jobs: + relocate-and-verify: + if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Relocate regression coverage + shell: python + run: | + from pathlib import Path + + def replace_once(path: str, old: str, new: str) -> None: + p = Path(path) + text = p.read_text(encoding="utf-8") + count = text.count(old) + if count != 1: + raise SystemExit(f"{path}: expected one anchor, found {count}") + p.write_text(text.replace(old, new, 1), encoding="utf-8") + + replace_once( + ".github/scripts/pr-quality.test.cjs", + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + );''', + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + ); + assert.equal( + assessPrDescription("'), + false, + );''', + ''' assert.equal( + hasScreenshotEvidence(''), + false, + ); + assert.equal( + hasScreenshotEvidence(" world"), "Hello world"); + });''', + ''' it("strips HTML comments, including an unterminated comment through EOF", () => { + assert.equal(clean("Hello world"), "Hello world"); + assert.equal(clean("\\nVisible text"), "Visible text"); + });''', + ) + + replace_once( + "tests/release-notes.test.ts", + ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); + }); + }); + + describe("joinCarriedPreviewNotes",''', + ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); + }); + + test("HTML comments do not become meaningful carried notes", () => { + expect(hasMeaningfulCarriedNotes("")).toBe(false); + expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); + }); + }); + + describe("joinCarriedPreviewNotes",''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + ''' invalidateProjectConfigDiagnosticsCache, + parseTrustedProjectPathsFromCodexConfig,''', + ''' invalidateProjectConfigDiagnosticsCache, + parseTomlDocument, + parseTrustedProjectPathsFromCodexConfig,''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + '''describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + '''describe("parseTomlDocument", () => { + test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { + const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); + expect(typeof malformed.root.model_provider).toBe("string"); + + const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); + expect(valid.root.model_provider).toBe("provider\\\\name"); + }, 2_000); + }); + + describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + ) + + replace_once( + "tests/codex-inject.test.ts", + ''' test("preserves non-opencodex routed model names during fallback restore", () => {''', + ''' test("malformed quoted root values cannot wedge restore transforms", () => { + const slashRun = "\\\\".repeat(64); + const stripped = stripOpencodexConfig([ + 'model_provider = "opencodex"', + `model = "${slashRun}`, + `model_catalog_json = "${slashRun}`, + "", + ].join("\\n")); + + expect(stripped).toContain(`model = "${slashRun}`); + expect(stripped).toContain(`model_catalog_json = "${slashRun}`); + }, 2_000); + + test("preserves non-opencodex routed model names during fallback restore", () => {''', + ) + + replace_once( + "tests/codex-plugins-doctor.test.ts", + ''' test("parses a table header with a trailing inline comment", () => {''', + ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + + test("parses a table header with a trailing inline comment", () => {''', + ) + + catch_all = Path("tests/codeql-real-findings-regressions.test.ts") + if not catch_all.exists(): + raise SystemExit("expected catch-all regression file to exist") + catch_all.unlink() + + doctor = Path("src/codex/plugins-doctor.ts") + doctor_text = doctor.read_text(encoding="utf-8") + doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run affected Bun suites + run: >- + bun test + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + tests/release-notes.test.ts + + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit relocated tests + shell: bash + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts + git diff --cached --quiet && exit 0 + git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" + git push origin HEAD:agent/codeql-real-findings-20260815 From bfa1931a961b49d3f3644aa05ad60b62db00b446 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:27:03 +0200 Subject: [PATCH 19/35] ci: replace CodeQL test relocation verifier --- .../workflows/tmp-relocate-codeql-tests.yml | 202 ------------------ 1 file changed, 202 deletions(-) delete mode 100644 .github/workflows/tmp-relocate-codeql-tests.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests.yml b/.github/workflows/tmp-relocate-codeql-tests.yml deleted file mode 100644 index 4598604aa4..0000000000 --- a/.github/workflows/tmp-relocate-codeql-tests.yml +++ /dev/null @@ -1,202 +0,0 @@ -name: Temporary relocate CodeQL regressions - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: write - -jobs: - relocate-and-verify: - if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Relocate regression coverage - shell: python - run: | - from pathlib import Path - - def replace_once(path: str, old: str, new: str) -> None: - p = Path(path) - text = p.read_text(encoding="utf-8") - count = text.count(old) - if count != 1: - raise SystemExit(f"{path}: expected one anchor, found {count}") - p.write_text(text.replace(old, new, 1), encoding="utf-8") - - replace_once( - ".github/scripts/pr-quality.test.cjs", - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - );''', - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - ); - assert.equal( - assessPrDescription("'), - false, - );''', - ''' assert.equal( - hasScreenshotEvidence(''), - false, - ); - assert.equal( - hasScreenshotEvidence(" world"), "Hello world"); - });''', - ''' it("strips HTML comments, including an unterminated comment through EOF", () => { - assert.equal(clean("Hello world"), "Hello world"); - assert.equal(clean("\\nVisible text"), "Visible text"); - });''', - ) - - replace_once( - "tests/release-notes.test.ts", - ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); - }); - }); - - describe("joinCarriedPreviewNotes",''', - ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); - }); - - test("HTML comments do not become meaningful carried notes", () => { - expect(hasMeaningfulCarriedNotes("")).toBe(false); - expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); - }); - }); - - describe("joinCarriedPreviewNotes",''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - ''' invalidateProjectConfigDiagnosticsCache, - parseTrustedProjectPathsFromCodexConfig,''', - ''' invalidateProjectConfigDiagnosticsCache, - parseTomlDocument, - parseTrustedProjectPathsFromCodexConfig,''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - '''describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - '''describe("parseTomlDocument", () => { - test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { - const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); - expect(typeof malformed.root.model_provider).toBe("string"); - - const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); - expect(valid.root.model_provider).toBe("provider\\\\name"); - }, 2_000); - }); - - describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - ) - - replace_once( - "tests/codex-inject.test.ts", - ''' test("preserves non-opencodex routed model names during fallback restore", () => {''', - ''' test("malformed quoted root values cannot wedge restore transforms", () => { - const slashRun = "\\\\".repeat(64); - const stripped = stripOpencodexConfig([ - 'model_provider = "opencodex"', - `model = "${slashRun}`, - `model_catalog_json = "${slashRun}`, - "", - ].join("\\n")); - - expect(stripped).toContain(`model = "${slashRun}`); - expect(stripped).toContain(`model_catalog_json = "${slashRun}`); - }, 2_000); - - test("preserves non-opencodex routed model names during fallback restore", () => {''', - ) - - replace_once( - "tests/codex-plugins-doctor.test.ts", - ''' test("parses a table header with a trailing inline comment", () => {''', - ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); - expect(result.applicable).toBe(true); - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); - - test("parses a table header with a trailing inline comment", () => {''', - ) - - catch_all = Path("tests/codeql-real-findings-regressions.test.ts") - if not catch_all.exists(): - raise SystemExit("expected catch-all regression file to exist") - catch_all.unlink() - - doctor = Path("src/codex/plugins-doctor.ts") - doctor_text = doctor.read_text(encoding="utf-8") - doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run affected Bun suites - run: >- - bun test - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - tests/release-notes.test.ts - - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit relocated tests - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts - git diff --cached --quiet && exit 0 - git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" - git push origin HEAD:agent/codeql-real-findings-20260815 From 2886570277f05e1e0893abbc8912956d22805e65 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:27:23 +0200 Subject: [PATCH 20/35] ci: rerun CodeQL test relocation --- .../tmp-relocate-codeql-tests-v2.yml | 198 ++++++++++++++++++ 1 file changed, 198 insertions(+) create mode 100644 .github/workflows/tmp-relocate-codeql-tests-v2.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests-v2.yml b/.github/workflows/tmp-relocate-codeql-tests-v2.yml new file mode 100644 index 0000000000..ba8712bd11 --- /dev/null +++ b/.github/workflows/tmp-relocate-codeql-tests-v2.yml @@ -0,0 +1,198 @@ +name: Temporary relocate CodeQL regressions v2 + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: write + +jobs: + relocate-and-verify: + if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Relocate regression coverage + shell: python + run: | + from pathlib import Path + + def replace_once(path: str, old: str, new: str) -> None: + p = Path(path) + text = p.read_text(encoding="utf-8") + count = text.count(old) + if count != 1: + raise SystemExit(f"{path}: expected one anchor, found {count}: {old!r}") + p.write_text(text.replace(old, new, 1), encoding="utf-8") + + replace_once( + ".github/scripts/pr-quality.test.cjs", + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + );''', + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + ); + assert.equal( + assessPrDescription("'), + false, + );''', + ''' assert.equal( + hasScreenshotEvidence(''), + false, + ); + assert.equal( + hasScreenshotEvidence(" world"), "Hello world");', + ''' assert.equal(clean("Hello world"), "Hello world"); + assert.equal(clean("\\nVisible text"), "Visible text");''', + ) + + replace_once( + "tests/release-notes.test.ts", + ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); + }); + }); + + describe("joinCarriedPreviewNotes",''', + ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); + }); + + test("HTML comments do not become meaningful carried notes", () => { + expect(hasMeaningfulCarriedNotes("")).toBe(false); + expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); + }); + }); + + describe("joinCarriedPreviewNotes",''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + ''' invalidateProjectConfigDiagnosticsCache, + parseTrustedProjectPathsFromCodexConfig,''', + ''' invalidateProjectConfigDiagnosticsCache, + parseTomlDocument, + parseTrustedProjectPathsFromCodexConfig,''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + '''describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + '''describe("parseTomlDocument", () => { + test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { + const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); + expect(typeof malformed.root.model_provider).toBe("string"); + + const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); + expect(valid.root.model_provider).toBe("provider\\\\name"); + }, 2_000); + }); + + describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + ) + + replace_once( + "tests/codex-inject.test.ts", + ''' test("preserves non-opencodex routed model names during fallback restore", () => {''', + ''' test("malformed quoted root values cannot wedge restore transforms", () => { + const slashRun = "\\\\".repeat(64); + const stripped = stripOpencodexConfig([ + 'model_provider = "opencodex"', + `model = "${slashRun}`, + `model_catalog_json = "${slashRun}`, + "", + ].join("\\n")); + + expect(stripped).toContain(`model = "${slashRun}`); + expect(stripped).toContain(`model_catalog_json = "${slashRun}`); + }, 2_000); + + test("preserves non-opencodex routed model names during fallback restore", () => {''', + ) + + replace_once( + "tests/codex-plugins-doctor.test.ts", + ''' test("parses a table header with a trailing inline comment", () => {''', + ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + + test("parses a table header with a trailing inline comment", () => {''', + ) + + catch_all = Path("tests/codeql-real-findings-regressions.test.ts") + if not catch_all.exists(): + raise SystemExit("expected catch-all regression file to exist") + catch_all.unlink() + + doctor = Path("src/codex/plugins-doctor.ts") + doctor_text = doctor.read_text(encoding="utf-8") + doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run affected Bun suites + run: >- + bun test + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + tests/release-notes.test.ts + + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit relocated tests + shell: bash + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts + git diff --cached --quiet && exit 0 + git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" + git push origin HEAD:agent/codeql-real-findings-20260815 From bd08cedaa3c31cb358cca41cf752aa9c5ece0579 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:27:55 +0200 Subject: [PATCH 21/35] ci: replace CodeQL relocation verifier v2 --- .../tmp-relocate-codeql-tests-v2.yml | 198 ------------------ 1 file changed, 198 deletions(-) delete mode 100644 .github/workflows/tmp-relocate-codeql-tests-v2.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests-v2.yml b/.github/workflows/tmp-relocate-codeql-tests-v2.yml deleted file mode 100644 index ba8712bd11..0000000000 --- a/.github/workflows/tmp-relocate-codeql-tests-v2.yml +++ /dev/null @@ -1,198 +0,0 @@ -name: Temporary relocate CodeQL regressions v2 - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: write - -jobs: - relocate-and-verify: - if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Relocate regression coverage - shell: python - run: | - from pathlib import Path - - def replace_once(path: str, old: str, new: str) -> None: - p = Path(path) - text = p.read_text(encoding="utf-8") - count = text.count(old) - if count != 1: - raise SystemExit(f"{path}: expected one anchor, found {count}: {old!r}") - p.write_text(text.replace(old, new, 1), encoding="utf-8") - - replace_once( - ".github/scripts/pr-quality.test.cjs", - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - );''', - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - ); - assert.equal( - assessPrDescription("'), - false, - );''', - ''' assert.equal( - hasScreenshotEvidence(''), - false, - ); - assert.equal( - hasScreenshotEvidence(" world"), "Hello world");', - ''' assert.equal(clean("Hello world"), "Hello world"); - assert.equal(clean("\\nVisible text"), "Visible text");''', - ) - - replace_once( - "tests/release-notes.test.ts", - ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); - }); - }); - - describe("joinCarriedPreviewNotes",''', - ''' expect(hasMeaningfulCarriedNotes(stripped)).toBe(false); - }); - - test("HTML comments do not become meaningful carried notes", () => { - expect(hasMeaningfulCarriedNotes("")).toBe(false); - expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); - }); - }); - - describe("joinCarriedPreviewNotes",''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - ''' invalidateProjectConfigDiagnosticsCache, - parseTrustedProjectPathsFromCodexConfig,''', - ''' invalidateProjectConfigDiagnosticsCache, - parseTomlDocument, - parseTrustedProjectPathsFromCodexConfig,''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - '''describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - '''describe("parseTomlDocument", () => { - test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { - const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); - expect(typeof malformed.root.model_provider).toBe("string"); - - const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); - expect(valid.root.model_provider).toBe("provider\\\\name"); - }, 2_000); - }); - - describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - ) - - replace_once( - "tests/codex-inject.test.ts", - ''' test("preserves non-opencodex routed model names during fallback restore", () => {''', - ''' test("malformed quoted root values cannot wedge restore transforms", () => { - const slashRun = "\\\\".repeat(64); - const stripped = stripOpencodexConfig([ - 'model_provider = "opencodex"', - `model = "${slashRun}`, - `model_catalog_json = "${slashRun}`, - "", - ].join("\\n")); - - expect(stripped).toContain(`model = "${slashRun}`); - expect(stripped).toContain(`model_catalog_json = "${slashRun}`); - }, 2_000); - - test("preserves non-opencodex routed model names during fallback restore", () => {''', - ) - - replace_once( - "tests/codex-plugins-doctor.test.ts", - ''' test("parses a table header with a trailing inline comment", () => {''', - ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); - expect(result.applicable).toBe(true); - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); - - test("parses a table header with a trailing inline comment", () => {''', - ) - - catch_all = Path("tests/codeql-real-findings-regressions.test.ts") - if not catch_all.exists(): - raise SystemExit("expected catch-all regression file to exist") - catch_all.unlink() - - doctor = Path("src/codex/plugins-doctor.ts") - doctor_text = doctor.read_text(encoding="utf-8") - doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run affected Bun suites - run: >- - bun test - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - tests/release-notes.test.ts - - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit relocated tests - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts - git diff --cached --quiet && exit 0 - git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" - git push origin HEAD:agent/codeql-real-findings-20260815 From c1a86be9cfe0426e020280a1d593d5dfec6845e2 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:28:16 +0200 Subject: [PATCH 22/35] ci: rerun CodeQL test relocation v3 --- .../tmp-relocate-codeql-tests-v3.yml | 192 ++++++++++++++++++ 1 file changed, 192 insertions(+) create mode 100644 .github/workflows/tmp-relocate-codeql-tests-v3.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests-v3.yml b/.github/workflows/tmp-relocate-codeql-tests-v3.yml new file mode 100644 index 0000000000..068ef24c9c --- /dev/null +++ b/.github/workflows/tmp-relocate-codeql-tests-v3.yml @@ -0,0 +1,192 @@ +name: Temporary relocate CodeQL regressions v3 + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: write + +jobs: + relocate-and-verify: + if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Relocate regression coverage + shell: python + run: | + from pathlib import Path + + def replace_once(path: str, old: str, new: str) -> None: + p = Path(path) + text = p.read_text(encoding="utf-8") + count = text.count(old) + if count != 1: + raise SystemExit(f"{path}: expected one anchor, found {count}: {old!r}") + p.write_text(text.replace(old, new, 1), encoding="utf-8") + + replace_once( + ".github/scripts/pr-quality.test.cjs", + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + );''', + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + ); + assert.equal( + assessPrDescription("'), + false, + );''', + ''' assert.equal( + hasScreenshotEvidence(''), + false, + ); + assert.equal( + hasScreenshotEvidence(" world"), "Hello world");', + ''' assert.equal(clean("Hello world"), "Hello world"); + assert.equal(clean("\\nVisible text"), "Visible text");''', + ) + + replace_once( + "tests/release-notes.test.ts", + '''describe("joinCarriedPreviewNotes", () => {''', + '''describe("hasMeaningfulCarriedNotes", () => { + test("HTML comments stay non-meaningful through a closing marker or EOF", () => { + expect(hasMeaningfulCarriedNotes("")).toBe(false); + expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); + }); + }); + + describe("joinCarriedPreviewNotes", () => {''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + ''' invalidateProjectConfigDiagnosticsCache, + parseTrustedProjectPathsFromCodexConfig,''', + ''' invalidateProjectConfigDiagnosticsCache, + parseTomlDocument, + parseTrustedProjectPathsFromCodexConfig,''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + '''describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + '''describe("parseTomlDocument", () => { + test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { + const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); + expect(typeof malformed.root.model_provider).toBe("string"); + + const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); + expect(valid.root.model_provider).toBe("provider\\\\name"); + }, 2_000); + }); + + describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + ) + + replace_once( + "tests/codex-inject.test.ts", + ''' test("preserves non-opencodex routed model names during fallback restore", () => {''', + ''' test("malformed quoted root values cannot wedge restore transforms", () => { + const slashRun = "\\\\".repeat(64); + const stripped = stripOpencodexConfig([ + 'model_provider = "opencodex"', + `model = "${slashRun}`, + `model_catalog_json = "${slashRun}`, + "", + ].join("\\n")); + + expect(stripped).toContain(`model = "${slashRun}`); + expect(stripped).toContain(`model_catalog_json = "${slashRun}`); + }, 2_000); + + test("preserves non-opencodex routed model names during fallback restore", () => {''', + ) + + replace_once( + "tests/codex-plugins-doctor.test.ts", + ''' test("parses a table header with a trailing inline comment", () => {''', + ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + + test("parses a table header with a trailing inline comment", () => {''', + ) + + catch_all = Path("tests/codeql-real-findings-regressions.test.ts") + if not catch_all.exists(): + raise SystemExit("expected catch-all regression file to exist") + catch_all.unlink() + + doctor = Path("src/codex/plugins-doctor.ts") + doctor_text = doctor.read_text(encoding="utf-8") + doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run affected Bun suites + run: >- + bun test + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + tests/release-notes.test.ts + + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit relocated tests + shell: bash + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts + git diff --cached --quiet && exit 0 + git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" + git push origin HEAD:agent/codeql-real-findings-20260815 From 4fb69196bdd75e274e78a53b71b8b92ac8e67151 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:29:49 +0200 Subject: [PATCH 23/35] ci: replace CodeQL relocation verifier v3 --- .../tmp-relocate-codeql-tests-v3.yml | 192 ------------------ 1 file changed, 192 deletions(-) delete mode 100644 .github/workflows/tmp-relocate-codeql-tests-v3.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests-v3.yml b/.github/workflows/tmp-relocate-codeql-tests-v3.yml deleted file mode 100644 index 068ef24c9c..0000000000 --- a/.github/workflows/tmp-relocate-codeql-tests-v3.yml +++ /dev/null @@ -1,192 +0,0 @@ -name: Temporary relocate CodeQL regressions v3 - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: write - -jobs: - relocate-and-verify: - if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Relocate regression coverage - shell: python - run: | - from pathlib import Path - - def replace_once(path: str, old: str, new: str) -> None: - p = Path(path) - text = p.read_text(encoding="utf-8") - count = text.count(old) - if count != 1: - raise SystemExit(f"{path}: expected one anchor, found {count}: {old!r}") - p.write_text(text.replace(old, new, 1), encoding="utf-8") - - replace_once( - ".github/scripts/pr-quality.test.cjs", - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - );''', - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - ); - assert.equal( - assessPrDescription("'), - false, - );''', - ''' assert.equal( - hasScreenshotEvidence(''), - false, - ); - assert.equal( - hasScreenshotEvidence(" world"), "Hello world");', - ''' assert.equal(clean("Hello world"), "Hello world"); - assert.equal(clean("\\nVisible text"), "Visible text");''', - ) - - replace_once( - "tests/release-notes.test.ts", - '''describe("joinCarriedPreviewNotes", () => {''', - '''describe("hasMeaningfulCarriedNotes", () => { - test("HTML comments stay non-meaningful through a closing marker or EOF", () => { - expect(hasMeaningfulCarriedNotes("")).toBe(false); - expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); - }); - }); - - describe("joinCarriedPreviewNotes", () => {''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - ''' invalidateProjectConfigDiagnosticsCache, - parseTrustedProjectPathsFromCodexConfig,''', - ''' invalidateProjectConfigDiagnosticsCache, - parseTomlDocument, - parseTrustedProjectPathsFromCodexConfig,''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - '''describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - '''describe("parseTomlDocument", () => { - test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { - const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); - expect(typeof malformed.root.model_provider).toBe("string"); - - const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); - expect(valid.root.model_provider).toBe("provider\\\\name"); - }, 2_000); - }); - - describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - ) - - replace_once( - "tests/codex-inject.test.ts", - ''' test("preserves non-opencodex routed model names during fallback restore", () => {''', - ''' test("malformed quoted root values cannot wedge restore transforms", () => { - const slashRun = "\\\\".repeat(64); - const stripped = stripOpencodexConfig([ - 'model_provider = "opencodex"', - `model = "${slashRun}`, - `model_catalog_json = "${slashRun}`, - "", - ].join("\\n")); - - expect(stripped).toContain(`model = "${slashRun}`); - expect(stripped).toContain(`model_catalog_json = "${slashRun}`); - }, 2_000); - - test("preserves non-opencodex routed model names during fallback restore", () => {''', - ) - - replace_once( - "tests/codex-plugins-doctor.test.ts", - ''' test("parses a table header with a trailing inline comment", () => {''', - ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); - expect(result.applicable).toBe(true); - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); - - test("parses a table header with a trailing inline comment", () => {''', - ) - - catch_all = Path("tests/codeql-real-findings-regressions.test.ts") - if not catch_all.exists(): - raise SystemExit("expected catch-all regression file to exist") - catch_all.unlink() - - doctor = Path("src/codex/plugins-doctor.ts") - doctor_text = doctor.read_text(encoding="utf-8") - doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run affected Bun suites - run: >- - bun test - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - tests/release-notes.test.ts - - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit relocated tests - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts - git diff --cached --quiet && exit 0 - git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" - git push origin HEAD:agent/codeql-real-findings-20260815 From d928b3e43e4ed57b12c7b3b6dbab2aef5cc12613 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:30:10 +0200 Subject: [PATCH 24/35] ci: rerun CodeQL test relocation v4 --- .../tmp-relocate-codeql-tests-v4.yml | 189 ++++++++++++++++++ 1 file changed, 189 insertions(+) create mode 100644 .github/workflows/tmp-relocate-codeql-tests-v4.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests-v4.yml b/.github/workflows/tmp-relocate-codeql-tests-v4.yml new file mode 100644 index 0000000000..724cd52a91 --- /dev/null +++ b/.github/workflows/tmp-relocate-codeql-tests-v4.yml @@ -0,0 +1,189 @@ +name: Temporary relocate CodeQL regressions v4 + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: write + +jobs: + relocate-and-verify: + if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Relocate regression coverage + shell: python + run: | + from pathlib import Path + + def replace_once(path: str, old: str, new: str) -> None: + p = Path(path) + text = p.read_text(encoding="utf-8") + count = text.count(old) + if count != 1: + raise SystemExit(f"{path}: expected one anchor, found {count}: {old!r}") + p.write_text(text.replace(old, new, 1), encoding="utf-8") + + replace_once( + ".github/scripts/pr-quality.test.cjs", + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + );''', + ''' assert.equal( + assessPrDescription("\\n\\n").reason, + "empty", + ); + assert.equal( + assessPrDescription("'), + false, + );''', + ''' assert.equal( + hasScreenshotEvidence(''), + false, + ); + assert.equal( + hasScreenshotEvidence(" world"), "Hello world");', + ''' assert.equal(clean("Hello world"), "Hello world"); + assert.equal(clean("\\nVisible text"), "Visible text");''', + ) + + replace_once( + "tests/release-notes.test.ts", + 'describe("joinCarriedPreviewNotes", () => {', + '''describe("hasMeaningfulCarriedNotes", () => { + test("HTML comments stay non-meaningful through a closing marker or EOF", () => { + expect(hasMeaningfulCarriedNotes("")).toBe(false); + expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); + }); + }); + + describe("joinCarriedPreviewNotes", () => {''', + ) + + replace_once( + "tests/project-config-warnings.test.ts", + " parseTrustedProjectPathsFromCodexConfig,", + " parseTomlDocument,\n parseTrustedProjectPathsFromCodexConfig,", + ) + + replace_once( + "tests/project-config-warnings.test.ts", + 'describe("parseTrustedProjectPathsFromCodexConfig", () => {', + '''describe("parseTomlDocument", () => { + test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { + const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); + expect(typeof malformed.root.model_provider).toBe("string"); + + const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); + expect(valid.root.model_provider).toBe("provider\\\\name"); + }, 2_000); + }); + + describe("parseTrustedProjectPathsFromCodexConfig", () => {''', + ) + + replace_once( + "tests/codex-inject.test.ts", + ' test("preserves non-opencodex routed model names during fallback restore", () => {', + ''' test("malformed quoted root values cannot wedge restore transforms", () => { + const slashRun = "\\\\".repeat(64); + const stripped = stripOpencodexConfig([ + 'model_provider = "opencodex"', + `model = "${slashRun}`, + `model_catalog_json = "${slashRun}`, + "", + ].join("\\n")); + + expect(stripped).toContain(`model = "${slashRun}`); + expect(stripped).toContain(`model_catalog_json = "${slashRun}`); + }, 2_000); + + test("preserves non-opencodex routed model names during fallback restore", () => {''', + ) + + replace_once( + "tests/codex-plugins-doctor.test.ts", + ' test("parses a table header with a trailing inline comment", () => {', + ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + + test("parses a table header with a trailing inline comment", () => {''', + ) + + catch_all = Path("tests/codeql-real-findings-regressions.test.ts") + if not catch_all.exists(): + raise SystemExit("expected catch-all regression file to exist") + catch_all.unlink() + + doctor = Path("src/codex/plugins-doctor.ts") + doctor_text = doctor.read_text(encoding="utf-8") + doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run affected Bun suites + run: >- + bun test + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + tests/release-notes.test.ts + + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit relocated tests + shell: bash + run: | + set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts + git diff --cached --quiet && exit 0 + git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" + git push origin HEAD:agent/codeql-real-findings-20260815 From 4aa64ac98519ad8d974401e60dc112a31c8695f2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 08:30:29 +0000 Subject: [PATCH 25/35] test: colocate CodeQL regressions with owner suites [test-relocation-applied] --- .github/scripts/issue-quality.test.cjs | 2 + .github/scripts/pr-quality.test.cjs | 8 +++ src/codex/plugins-doctor.ts | 2 +- .../codeql-real-findings-regressions.test.ts | 57 ------------------- tests/codex-inject.test.ts | 13 +++++ tests/codex-plugins-doctor.test.ts | 12 ++++ tests/project-config-warnings.test.ts | 13 ++++- tests/release-notes.test.ts | 10 +++- 8 files changed, 57 insertions(+), 60 deletions(-) delete mode 100644 tests/codeql-real-findings-regressions.test.ts diff --git a/.github/scripts/issue-quality.test.cjs b/.github/scripts/issue-quality.test.cjs index 15a4ec68ab..e61773e8d4 100644 --- a/.github/scripts/issue-quality.test.cjs +++ b/.github/scripts/issue-quality.test.cjs @@ -1379,6 +1379,8 @@ describe("normalisation", () => { it("strips HTML comments", () => { assert.equal(clean("Hello world"), "Hello world"); + assert.equal(clean("\nVisible text"), "Visible text"); }); it("normalises punctuation and capitalisation", () => { diff --git a/.github/scripts/pr-quality.test.cjs b/.github/scripts/pr-quality.test.cjs index efecf1f682..efa90abad9 100644 --- a/.github/scripts/pr-quality.test.cjs +++ b/.github/scripts/pr-quality.test.cjs @@ -68,6 +68,10 @@ describe("assessPrDescription", () => { assessPrDescription("\n\n").reason, "empty", ); + assert.equal( + assessPrDescription("'), false, ); + assert.equal( + hasScreenshotEvidence("\nVisible text")).toBe("Visible text"); - }); - - test("release-note comments stay non-meaningful through a closing marker or EOF", () => { - expect(hasMeaningfulCarriedNotes("")).toBe(false); - expect(hasMeaningfulCarriedNotes("\n## What's Changed\n* visible fix")).toBe(true); - }); - - test("malformed TOML basic strings stay bounded while escaped strings still parse", () => { - const started = performance.now(); - const malformed = parseTomlDocument('model_provider = "' + "\\".repeat(40)); - const elapsedMs = performance.now() - started; - expect(elapsedMs).toBeLessThan(100); - expect(typeof malformed.root.model_provider).toBe("string"); - - const valid = parseTomlDocument('model_provider = "provider\\\\name"'); - expect(valid.root.model_provider).toBe("provider\\name"); - }); - - test("TOML string matchers do not let backslash enter both repetition arms", () => { - const unsafe = '"(?:\\\\.|[^"])*"'; - const safe = '"(?:\\\\.|[^"\\\\])*"'; - const files = [ - "src/codex/project-config-warnings.ts", - "src/codex/inject.ts", - "src/codex/plugins-doctor.ts", - ]; - - for (const path of files) { - const source = readFileSync(join(process.cwd(), path), "utf8"); - expect(source).not.toContain(unsafe); - expect(source).toContain(safe); - } - }); -}); \ No newline at end of file diff --git a/tests/codex-inject.test.ts b/tests/codex-inject.test.ts index 540830f8c2..43ace994e1 100644 --- a/tests/codex-inject.test.ts +++ b/tests/codex-inject.test.ts @@ -115,6 +115,19 @@ describe("Codex config injection", () => { expect(stripped).toContain('model_verbosity = "high"'); }); + test("malformed quoted root values cannot wedge restore transforms", () => { + const slashRun = "\\".repeat(64); + const stripped = stripOpencodexConfig([ + 'model_provider = "opencodex"', + `model = "${slashRun}`, + `model_catalog_json = "${slashRun}`, + "", + ].join("\n")); + + expect(stripped).toContain(`model = "${slashRun}`); + expect(stripped).toContain(`model_catalog_json = "${slashRun}`); + }, 2_000); + test("preserves non-opencodex routed model names during fallback restore", () => { const stripped = stripOpencodexConfig([ 'model_provider = "proxy"', diff --git a/tests/codex-plugins-doctor.test.ts b/tests/codex-plugins-doctor.test.ts index af7ff029c6..681ac48adf 100644 --- a/tests/codex-plugins-doctor.test.ts +++ b/tests/codex-plugins-doctor.test.ts @@ -120,6 +120,18 @@ describe("diagnoseCodexBundledPlugins (direct, platform-injected)", () => { } }); + test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${"\\".repeat(64)}\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + test("parses a table header with a trailing inline comment", () => { const { dir, configPath } = makeConfig( `[marketplaces.openai-bundled] # bundled\nsource_type = "local"\nsource = "X:\\\\gone"\n`, diff --git a/tests/project-config-warnings.test.ts b/tests/project-config-warnings.test.ts index c5609f9c56..eb079760af 100644 --- a/tests/project-config-warnings.test.ts +++ b/tests/project-config-warnings.test.ts @@ -9,6 +9,7 @@ import { explainProjectConfigBypass, isGlobalOpencodexRoutingActive, invalidateProjectConfigDiagnosticsCache, + parseTomlDocument, parseTrustedProjectPathsFromCodexConfig, relPath, resolveEffectiveProjectModelProvider, @@ -119,7 +120,17 @@ base_url = "http://127.0.0.1:10100/v1" }); }); -describe("parseTrustedProjectPathsFromCodexConfig", () => { +describe("parseTomlDocument", () => { + test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { + const malformed = parseTomlDocument('model_provider = "' + "\\".repeat(64)); + expect(typeof malformed.root.model_provider).toBe("string"); + + const valid = parseTomlDocument('model_provider = "provider\\\\name"'); + expect(valid.root.model_provider).toBe("provider\\name"); + }, 2_000); + }); + + describe("parseTrustedProjectPathsFromCodexConfig", () => { test("collects only trusted project paths", () => { const text = ` [projects.'C:\\repo-a'] diff --git a/tests/release-notes.test.ts b/tests/release-notes.test.ts index e9a0562c82..aa6bc7d296 100644 --- a/tests/release-notes.test.ts +++ b/tests/release-notes.test.ts @@ -172,7 +172,15 @@ describe("stripCarriedReleaseNotes", () => { }); }); -describe("joinCarriedPreviewNotes", () => { +describe("hasMeaningfulCarriedNotes", () => { + test("HTML comments stay non-meaningful through a closing marker or EOF", () => { + expect(hasMeaningfulCarriedNotes("")).toBe(false); + expect(hasMeaningfulCarriedNotes("\n## What's Changed\n* visible fix")).toBe(true); + }); + }); + + describe("joinCarriedPreviewNotes", () => { test("aggregates multiple incremental preview bodies in order", () => { const joined = joinCarriedPreviewNotes([ "## What's Changed\n* fix A", From 84a30a91e6a85b39015f5d3edef5000770b7e483 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:31:05 +0200 Subject: [PATCH 26/35] ci: remove temporary CodeQL relocation workflow --- .../tmp-relocate-codeql-tests-v4.yml | 189 ------------------ 1 file changed, 189 deletions(-) delete mode 100644 .github/workflows/tmp-relocate-codeql-tests-v4.yml diff --git a/.github/workflows/tmp-relocate-codeql-tests-v4.yml b/.github/workflows/tmp-relocate-codeql-tests-v4.yml deleted file mode 100644 index 724cd52a91..0000000000 --- a/.github/workflows/tmp-relocate-codeql-tests-v4.yml +++ /dev/null @@ -1,189 +0,0 @@ -name: Temporary relocate CodeQL regressions v4 - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: write - -jobs: - relocate-and-verify: - if: ${{ !contains(github.event.head_commit.message, '[test-relocation-applied]') }} - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Relocate regression coverage - shell: python - run: | - from pathlib import Path - - def replace_once(path: str, old: str, new: str) -> None: - p = Path(path) - text = p.read_text(encoding="utf-8") - count = text.count(old) - if count != 1: - raise SystemExit(f"{path}: expected one anchor, found {count}: {old!r}") - p.write_text(text.replace(old, new, 1), encoding="utf-8") - - replace_once( - ".github/scripts/pr-quality.test.cjs", - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - );''', - ''' assert.equal( - assessPrDescription("\\n\\n").reason, - "empty", - ); - assert.equal( - assessPrDescription("'), - false, - );''', - ''' assert.equal( - hasScreenshotEvidence(''), - false, - ); - assert.equal( - hasScreenshotEvidence(" world"), "Hello world");', - ''' assert.equal(clean("Hello world"), "Hello world"); - assert.equal(clean("\\nVisible text"), "Visible text");''', - ) - - replace_once( - "tests/release-notes.test.ts", - 'describe("joinCarriedPreviewNotes", () => {', - '''describe("hasMeaningfulCarriedNotes", () => { - test("HTML comments stay non-meaningful through a closing marker or EOF", () => { - expect(hasMeaningfulCarriedNotes("")).toBe(false); - expect(hasMeaningfulCarriedNotes("\\n## What's Changed\\n* visible fix")).toBe(true); - }); - }); - - describe("joinCarriedPreviewNotes", () => {''', - ) - - replace_once( - "tests/project-config-warnings.test.ts", - " parseTrustedProjectPathsFromCodexConfig,", - " parseTomlDocument,\n parseTrustedProjectPathsFromCodexConfig,", - ) - - replace_once( - "tests/project-config-warnings.test.ts", - 'describe("parseTrustedProjectPathsFromCodexConfig", () => {', - '''describe("parseTomlDocument", () => { - test("malformed basic strings cannot wedge parsing and escaped strings still parse", () => { - const malformed = parseTomlDocument('model_provider = "' + "\\\\".repeat(64)); - expect(typeof malformed.root.model_provider).toBe("string"); - - const valid = parseTomlDocument('model_provider = "provider\\\\\\\\name"'); - expect(valid.root.model_provider).toBe("provider\\\\name"); - }, 2_000); - }); - - describe("parseTrustedProjectPathsFromCodexConfig", () => {''', - ) - - replace_once( - "tests/codex-inject.test.ts", - ' test("preserves non-opencodex routed model names during fallback restore", () => {', - ''' test("malformed quoted root values cannot wedge restore transforms", () => { - const slashRun = "\\\\".repeat(64); - const stripped = stripOpencodexConfig([ - 'model_provider = "opencodex"', - `model = "${slashRun}`, - `model_catalog_json = "${slashRun}`, - "", - ].join("\\n")); - - expect(stripped).toContain(`model = "${slashRun}`); - expect(stripped).toContain(`model_catalog_json = "${slashRun}`); - }, 2_000); - - test("preserves non-opencodex routed model names during fallback restore", () => {''', - ) - - replace_once( - "tests/codex-plugins-doctor.test.ts", - ' test("parses a table header with a trailing inline comment", () => {', - ''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${"\\\\".repeat(64)}\\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); - expect(result.applicable).toBe(true); - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); - - test("parses a table header with a trailing inline comment", () => {''', - ) - - catch_all = Path("tests/codeql-real-findings-regressions.test.ts") - if not catch_all.exists(): - raise SystemExit("expected catch-all regression file to exist") - catch_all.unlink() - - doctor = Path("src/codex/plugins-doctor.ts") - doctor_text = doctor.read_text(encoding="utf-8") - doctor.write_text(doctor_text.rstrip("\n") + "\n", encoding="utf-8") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run affected Bun suites - run: >- - bun test - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - tests/release-notes.test.ts - - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit relocated tests - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add .github/scripts/pr-quality.test.cjs .github/scripts/issue-quality.test.cjs tests/release-notes.test.ts tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/codeql-real-findings-regressions.test.ts src/codex/plugins-doctor.ts - git diff --cached --quiet && exit 0 - git commit -m "test: colocate CodeQL regressions with owner suites [test-relocation-applied]" - git push origin HEAD:agent/codeql-real-findings-20260815 From 87284f3b006d558f77e858ed5e584041cc5ff838 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:31:17 +0200 Subject: [PATCH 27/35] ci: verify colocated CodeQL regressions --- .../workflows/tmp-codeql-colocated-final.yml | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/tmp-codeql-colocated-final.yml diff --git a/.github/workflows/tmp-codeql-colocated-final.yml b/.github/workflows/tmp-codeql-colocated-final.yml new file mode 100644 index 0000000000..99b55c14de --- /dev/null +++ b/.github/workflows/tmp-codeql-colocated-final.yml @@ -0,0 +1,42 @@ +name: Temporary CodeQL colocated final verification + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.14 + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run affected Bun suites + run: >- + bun test + tests/project-config-warnings.test.ts + tests/codex-inject.test.ts + tests/codex-plugins-doctor.test.ts + tests/release-notes.test.ts + + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + + - name: Typecheck + run: bun run typecheck + + - name: Check branch diff + run: git diff --check origin/dev...HEAD From ec80dfff74855de5342dd3d2a4530242bc149e90 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:31:52 +0200 Subject: [PATCH 28/35] ci: remove temporary final CodeQL verifier --- .../workflows/tmp-codeql-colocated-final.yml | 42 ------------------- 1 file changed, 42 deletions(-) delete mode 100644 .github/workflows/tmp-codeql-colocated-final.yml diff --git a/.github/workflows/tmp-codeql-colocated-final.yml b/.github/workflows/tmp-codeql-colocated-final.yml deleted file mode 100644 index 99b55c14de..0000000000 --- a/.github/workflows/tmp-codeql-colocated-final.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Temporary CodeQL colocated final verification - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -permissions: - contents: read - -jobs: - verify: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@v2 - with: - bun-version: 1.3.14 - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run affected Bun suites - run: >- - bun test - tests/project-config-warnings.test.ts - tests/codex-inject.test.ts - tests/codex-plugins-doctor.test.ts - tests/release-notes.test.ts - - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - - name: Typecheck - run: bun run typecheck - - - name: Check branch diff - run: git diff --check origin/dev...HEAD From 9a1e2d849ef87c0cd16df36d619a2128a510a1c0 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:45:51 +0200 Subject: [PATCH 29/35] ci: apply viable CodeRabbit fixes for PR 1750 --- .github/workflows/tmp-fix-coderabbit-1750.yml | 118 ++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 .github/workflows/tmp-fix-coderabbit-1750.yml diff --git a/.github/workflows/tmp-fix-coderabbit-1750.yml b/.github/workflows/tmp-fix-coderabbit-1750.yml new file mode 100644 index 0000000000..787fcf2d29 --- /dev/null +++ b/.github/workflows/tmp-fix-coderabbit-1750.yml @@ -0,0 +1,118 @@ +name: Temporary PR 1750 CodeRabbit fixes + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +concurrency: + group: tmp-fix-coderabbit-1750-${{ github.ref }} + cancel-in-progress: false + +jobs: + fix-and-verify: + name: Fix and verify viable CodeRabbit findings + # This temporary job must push the verified fix commit back to the PR branch. + permissions: + contents: write + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + fetch-depth: 0 + + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 + with: + bun-version: 1.3.14 + + - name: Apply fixes + shell: python + run: | + from pathlib import Path + + source = Path("src/codex/plugins-doctor.ts") + source_text = source.read_text(encoding="utf-8") + old_regex = r''' const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|[^#]+?)\s*(?:#.*)?$/);''' + new_regex = r''' const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|[^\s#]+)\s*(?:#.*)?$/);''' + if source_text.count(old_regex) != 1: + raise SystemExit("plugins-doctor matcher anchor did not match exactly once") + source.write_text(source_text.replace(old_regex, new_regex, 1), encoding="utf-8") + + tests = Path("tests/codex-plugins-doctor.test.ts") + test_text = tests.read_text(encoding="utf-8") + old_block = r''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${"\\".repeat(64)}\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); +''' + new_block = r''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${"\\".repeat(64)}\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ + platform: "win32", + configPath, + locateCurrent: () => null, + }); + expect(result.applicable).toBe(true); + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + + test("malformed quoted values with long trailing whitespace are not parsed as bare values", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${" ".repeat(20_000)}x\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ + platform: "win32", + configPath, + locateCurrent: () => null, + }); + expect(result.applicable).toBe(true); + if (result.applicable) { + expect(result.marketplace.sourceType).toBe("local"); + expect(result.marketplace.source).toBeNull(); + } + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); +''' + if test_text.count(old_block) != 1: + raise SystemExit("malformed marketplace test anchor did not match exactly once") + tests.write_text(test_text.replace(old_block, new_block, 1), encoding="utf-8") + + - name: Install dependencies + run: bun install --frozen-lockfile + + - name: Run affected tests + run: bun test tests/codex-plugins-doctor.test.ts + + - name: Typecheck + run: bun run typecheck + + - name: Check diff + run: git diff --check + + - name: Commit fixes and remove temporary workflow + shell: bash + run: | + set -euo pipefail + rm .github/workflows/tmp-fix-coderabbit-1750.yml + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add src/codex/plugins-doctor.ts tests/codex-plugins-doctor.test.ts .github/workflows/tmp-fix-coderabbit-1750.yml + git diff --cached --quiet && exit 0 + git commit -m "fix: address viable CodeRabbit parser findings" + git push origin HEAD:agent/codeql-real-findings-20260815 From e2714efb1bfb1eb06ba78918f543811c7989f0e8 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:46:42 +0200 Subject: [PATCH 30/35] ci: fix PR 1750 CodeRabbit helper workflow --- .github/workflows/tmp-fix-coderabbit-1750.yml | 68 ++++--------------- 1 file changed, 15 insertions(+), 53 deletions(-) diff --git a/.github/workflows/tmp-fix-coderabbit-1750.yml b/.github/workflows/tmp-fix-coderabbit-1750.yml index 787fcf2d29..35a8b128d8 100644 --- a/.github/workflows/tmp-fix-coderabbit-1750.yml +++ b/.github/workflows/tmp-fix-coderabbit-1750.yml @@ -33,65 +33,27 @@ jobs: source = Path("src/codex/plugins-doctor.ts") source_text = source.read_text(encoding="utf-8") - old_regex = r''' const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|[^#]+?)\s*(?:#.*)?$/);''' - new_regex = r''' const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|[^\s#]+)\s*(?:#.*)?$/);''' + old_regex = ' const m = line.match(/^\\s*([A-Za-z0-9_-]+)\\s*=\\s*("(?:\\\\.|[^"\\\\])*"|\'[^\']*\'|[^#]+?)\\s*(?:#.*)?$/);' + new_regex = ' const m = line.match(/^\\s*([A-Za-z0-9_-]+)\\s*=\\s*("(?:\\\\.|[^"\\\\])*"|\'[^\']*\'|[^\\s#]+)\\s*(?:#.*)?$/);' if source_text.count(old_regex) != 1: raise SystemExit("plugins-doctor matcher anchor did not match exactly once") source.write_text(source_text.replace(old_regex, new_regex, 1), encoding="utf-8") tests = Path("tests/codex-plugins-doctor.test.ts") test_text = tests.read_text(encoding="utf-8") - old_block = r''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${"\\".repeat(64)}\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); - expect(result.applicable).toBe(true); - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); -''' - new_block = r''' test("malformed quoted marketplace values cannot wedge diagnosis", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${"\\".repeat(64)}\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ - platform: "win32", - configPath, - locateCurrent: () => null, - }); - expect(result.applicable).toBe(true); - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); - - test("malformed quoted values with long trailing whitespace are not parsed as bare values", () => { - const { dir, configPath } = makeConfig( - `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${" ".repeat(20_000)}x\n`, - ); - try { - const result = diagnoseCodexBundledPlugins({ - platform: "win32", - configPath, - locateCurrent: () => null, - }); - expect(result.applicable).toBe(true); - if (result.applicable) { - expect(result.marketplace.sourceType).toBe("local"); - expect(result.marketplace.source).toBeNull(); - } - } finally { - rmSync(dir, { recursive: true, force: true }); - } - }, 2_000); -''' - if test_text.count(old_block) != 1: - raise SystemExit("malformed marketplace test anchor did not match exactly once") - tests.write_text(test_text.replace(old_block, new_block, 1), encoding="utf-8") + marker = ' test("malformed quoted marketplace values cannot wedge diagnosis", () => {' + next_marker = ' test("parses a table header with a trailing inline comment", () => {' + start = test_text.index(marker) + end = test_text.index(next_marker, start) + block = test_text[start:end] + old_call = ' const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath });' + new_call = ' const result = diagnoseCodexBundledPlugins({\n platform: "win32",\n configPath,\n locateCurrent: () => null,\n });' + if block.count(old_call) != 1: + raise SystemExit("malformed marketplace diagnosis call did not match exactly once") + block = block.replace(old_call, new_call, 1) + whitespace_test = ' test("malformed quoted values with long trailing whitespace are not parsed as bare values", () => {\n const { dir, configPath } = makeConfig(\n `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${" ".repeat(20_000)}x\\n`,\n );\n try {\n const result = diagnoseCodexBundledPlugins({\n platform: "win32",\n configPath,\n locateCurrent: () => null,\n });\n expect(result.applicable).toBe(true);\n if (result.applicable) {\n expect(result.marketplace.sourceType).toBe("local");\n expect(result.marketplace.source).toBeNull();\n }\n } finally {\n rmSync(dir, { recursive: true, force: true });\n }\n }, 2_000);\n\n' + test_text = test_text[:start] + block + whitespace_test + test_text[end:] + tests.write_text(test_text, encoding="utf-8") - name: Install dependencies run: bun install --frozen-lockfile From d442cf1e90954bf6709c77fbc9fac78f0223fdd1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 08:47:06 +0000 Subject: [PATCH 31/35] fix: address viable CodeRabbit parser findings --- .github/workflows/tmp-fix-coderabbit-1750.yml | 80 ------------------- src/codex/plugins-doctor.ts | 2 +- tests/codex-plugins-doctor.test.ts | 26 +++++- 3 files changed, 26 insertions(+), 82 deletions(-) delete mode 100644 .github/workflows/tmp-fix-coderabbit-1750.yml diff --git a/.github/workflows/tmp-fix-coderabbit-1750.yml b/.github/workflows/tmp-fix-coderabbit-1750.yml deleted file mode 100644 index 35a8b128d8..0000000000 --- a/.github/workflows/tmp-fix-coderabbit-1750.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Temporary PR 1750 CodeRabbit fixes - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -concurrency: - group: tmp-fix-coderabbit-1750-${{ github.ref }} - cancel-in-progress: false - -jobs: - fix-and-verify: - name: Fix and verify viable CodeRabbit findings - # This temporary job must push the verified fix commit back to the PR branch. - permissions: - contents: write - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - with: - fetch-depth: 0 - - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 - with: - bun-version: 1.3.14 - - - name: Apply fixes - shell: python - run: | - from pathlib import Path - - source = Path("src/codex/plugins-doctor.ts") - source_text = source.read_text(encoding="utf-8") - old_regex = ' const m = line.match(/^\\s*([A-Za-z0-9_-]+)\\s*=\\s*("(?:\\\\.|[^"\\\\])*"|\'[^\']*\'|[^#]+?)\\s*(?:#.*)?$/);' - new_regex = ' const m = line.match(/^\\s*([A-Za-z0-9_-]+)\\s*=\\s*("(?:\\\\.|[^"\\\\])*"|\'[^\']*\'|[^\\s#]+)\\s*(?:#.*)?$/);' - if source_text.count(old_regex) != 1: - raise SystemExit("plugins-doctor matcher anchor did not match exactly once") - source.write_text(source_text.replace(old_regex, new_regex, 1), encoding="utf-8") - - tests = Path("tests/codex-plugins-doctor.test.ts") - test_text = tests.read_text(encoding="utf-8") - marker = ' test("malformed quoted marketplace values cannot wedge diagnosis", () => {' - next_marker = ' test("parses a table header with a trailing inline comment", () => {' - start = test_text.index(marker) - end = test_text.index(next_marker, start) - block = test_text[start:end] - old_call = ' const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath });' - new_call = ' const result = diagnoseCodexBundledPlugins({\n platform: "win32",\n configPath,\n locateCurrent: () => null,\n });' - if block.count(old_call) != 1: - raise SystemExit("malformed marketplace diagnosis call did not match exactly once") - block = block.replace(old_call, new_call, 1) - whitespace_test = ' test("malformed quoted values with long trailing whitespace are not parsed as bare values", () => {\n const { dir, configPath } = makeConfig(\n `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "${" ".repeat(20_000)}x\\n`,\n );\n try {\n const result = diagnoseCodexBundledPlugins({\n platform: "win32",\n configPath,\n locateCurrent: () => null,\n });\n expect(result.applicable).toBe(true);\n if (result.applicable) {\n expect(result.marketplace.sourceType).toBe("local");\n expect(result.marketplace.source).toBeNull();\n }\n } finally {\n rmSync(dir, { recursive: true, force: true });\n }\n }, 2_000);\n\n' - test_text = test_text[:start] + block + whitespace_test + test_text[end:] - tests.write_text(test_text, encoding="utf-8") - - - name: Install dependencies - run: bun install --frozen-lockfile - - - name: Run affected tests - run: bun test tests/codex-plugins-doctor.test.ts - - - name: Typecheck - run: bun run typecheck - - - name: Check diff - run: git diff --check - - - name: Commit fixes and remove temporary workflow - shell: bash - run: | - set -euo pipefail - rm .github/workflows/tmp-fix-coderabbit-1750.yml - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add src/codex/plugins-doctor.ts tests/codex-plugins-doctor.test.ts .github/workflows/tmp-fix-coderabbit-1750.yml - git diff --cached --quiet && exit 0 - git commit -m "fix: address viable CodeRabbit parser findings" - git push origin HEAD:agent/codeql-real-findings-20260815 diff --git a/src/codex/plugins-doctor.ts b/src/codex/plugins-doctor.ts index ed7aa88b1e..d73a9c7506 100644 --- a/src/codex/plugins-doctor.ts +++ b/src/codex/plugins-doctor.ts @@ -59,7 +59,7 @@ function readMarketplaceTable(configText: string, name: string): Record { `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${"\\".repeat(64)}\n`, ); try { - const result = diagnoseCodexBundledPlugins({ platform: "win32", configPath }); + const result = diagnoseCodexBundledPlugins({ + platform: "win32", + configPath, + locateCurrent: () => null, + }); expect(result.applicable).toBe(true); } finally { rmSync(dir, { recursive: true, force: true }); } }, 2_000); + test("malformed quoted values with long trailing whitespace are not parsed as bare values", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "${" ".repeat(20_000)}x\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ + platform: "win32", + configPath, + locateCurrent: () => null, + }); + expect(result.applicable).toBe(true); + if (result.applicable) { + expect(result.marketplace.sourceType).toBe("local"); + expect(result.marketplace.source).toBeNull(); + } + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }, 2_000); + test("parses a table header with a trailing inline comment", () => { const { dir, configPath } = makeConfig( `[marketplaces.openai-bundled] # bundled\nsource_type = "local"\nsource = "X:\\\\gone"\n`, From fa3e7875e67839b57e89b0417b1fe24553b18892 Mon Sep 17 00:00:00 2001 From: Wibias <37517432+Wibias@users.noreply.github.com> Date: Sat, 15 Aug 2026 10:53:38 +0200 Subject: [PATCH 32/35] ci: verify final CodeRabbit quote fix --- .../tmp-fix-coderabbit-1750-quote.yml | 64 +++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 .github/workflows/tmp-fix-coderabbit-1750-quote.yml diff --git a/.github/workflows/tmp-fix-coderabbit-1750-quote.yml b/.github/workflows/tmp-fix-coderabbit-1750-quote.yml new file mode 100644 index 0000000000..31f75854b7 --- /dev/null +++ b/.github/workflows/tmp-fix-coderabbit-1750-quote.yml @@ -0,0 +1,64 @@ +name: Temporary PR 1750 quote fix + +on: + push: + branches: + - agent/codeql-real-findings-20260815 + +concurrency: + group: tmp-fix-coderabbit-1750-quote-${{ github.ref }} + cancel-in-progress: false + +jobs: + fix-and-verify: + name: Fix and verify malformed quote handling + permissions: + contents: write + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + fetch-depth: 0 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 + with: + bun-version: 1.3.14 + - name: Apply fix and regression + shell: python + run: | + from pathlib import Path + source = Path("src/codex/plugins-doctor.ts") + text = source.read_text(encoding="utf-8") + old = r'''|[^\s#]+)\s*(?:#.*)?$/);''' + new = r'''|(?!["'])[^\s#]+)\s*(?:#.*)?$/);''' + if text.count(old) != 1: + raise SystemExit(f"source anchor count was {text.count(old)}") + source.write_text(text.replace(old, new, 1), encoding="utf-8") + + tests = Path("tests/codex-plugins-doctor.test.ts") + text = tests.read_text(encoding="utf-8") + anchor = ' test("parses a table header with a trailing inline comment", () => {' + regression = ' test("unterminated quoted values are rejected instead of parsed as bare values", () => {\n const { dir, configPath } = makeConfig(\n `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "unterminated\\n`,\n );\n try {\n const result = diagnoseCodexBundledPlugins({\n platform: "win32",\n configPath,\n locateCurrent: () => null,\n });\n expect(result.applicable).toBe(true);\n if (result.applicable) {\n expect(result.marketplace.sourceType).toBe("local");\n expect(result.marketplace.source).toBeNull();\n expect(result.stale).toBe(false);\n expect(result.suggestedRepair).toBeNull();\n }\n } finally {\n rmSync(dir, { recursive: true, force: true });\n }\n });\n\n' + if text.count(anchor) != 1: + raise SystemExit(f"test anchor count was {text.count(anchor)}") + tests.write_text(text.replace(anchor, regression + anchor, 1), encoding="utf-8") + - name: Install dependencies + run: bun install --frozen-lockfile + - name: Run affected Bun suites + run: bun test tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/release-notes.test.ts + - name: Run quality-gate Node suites + run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs + - name: Typecheck + run: bun run typecheck + - name: Check branch diff + run: git diff --check origin/dev...HEAD + - name: Commit fix and remove temporary workflow + shell: bash + run: | + set -euo pipefail + rm .github/workflows/tmp-fix-coderabbit-1750-quote.yml + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add src/codex/plugins-doctor.ts tests/codex-plugins-doctor.test.ts .github/workflows/tmp-fix-coderabbit-1750-quote.yml + git commit -m "fix: reject malformed quoted marketplace values" + git push origin HEAD:agent/codeql-real-findings-20260815 From 0edbacb5a2cc789f11a4a59f762a262f7fcaa7f8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 15 Aug 2026 08:53:57 +0000 Subject: [PATCH 33/35] fix: reject malformed quoted marketplace values --- .../tmp-fix-coderabbit-1750-quote.yml | 64 ------------------- src/codex/plugins-doctor.ts | 2 +- tests/codex-plugins-doctor.test.ts | 22 +++++++ 3 files changed, 23 insertions(+), 65 deletions(-) delete mode 100644 .github/workflows/tmp-fix-coderabbit-1750-quote.yml diff --git a/.github/workflows/tmp-fix-coderabbit-1750-quote.yml b/.github/workflows/tmp-fix-coderabbit-1750-quote.yml deleted file mode 100644 index 31f75854b7..0000000000 --- a/.github/workflows/tmp-fix-coderabbit-1750-quote.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Temporary PR 1750 quote fix - -on: - push: - branches: - - agent/codeql-real-findings-20260815 - -concurrency: - group: tmp-fix-coderabbit-1750-quote-${{ github.ref }} - cancel-in-progress: false - -jobs: - fix-and-verify: - name: Fix and verify malformed quote handling - permissions: - contents: write - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - with: - fetch-depth: 0 - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 - with: - bun-version: 1.3.14 - - name: Apply fix and regression - shell: python - run: | - from pathlib import Path - source = Path("src/codex/plugins-doctor.ts") - text = source.read_text(encoding="utf-8") - old = r'''|[^\s#]+)\s*(?:#.*)?$/);''' - new = r'''|(?!["'])[^\s#]+)\s*(?:#.*)?$/);''' - if text.count(old) != 1: - raise SystemExit(f"source anchor count was {text.count(old)}") - source.write_text(text.replace(old, new, 1), encoding="utf-8") - - tests = Path("tests/codex-plugins-doctor.test.ts") - text = tests.read_text(encoding="utf-8") - anchor = ' test("parses a table header with a trailing inline comment", () => {' - regression = ' test("unterminated quoted values are rejected instead of parsed as bare values", () => {\n const { dir, configPath } = makeConfig(\n `[marketplaces.openai-bundled]\\nsource_type = "local"\\nsource = "unterminated\\n`,\n );\n try {\n const result = diagnoseCodexBundledPlugins({\n platform: "win32",\n configPath,\n locateCurrent: () => null,\n });\n expect(result.applicable).toBe(true);\n if (result.applicable) {\n expect(result.marketplace.sourceType).toBe("local");\n expect(result.marketplace.source).toBeNull();\n expect(result.stale).toBe(false);\n expect(result.suggestedRepair).toBeNull();\n }\n } finally {\n rmSync(dir, { recursive: true, force: true });\n }\n });\n\n' - if text.count(anchor) != 1: - raise SystemExit(f"test anchor count was {text.count(anchor)}") - tests.write_text(text.replace(anchor, regression + anchor, 1), encoding="utf-8") - - name: Install dependencies - run: bun install --frozen-lockfile - - name: Run affected Bun suites - run: bun test tests/project-config-warnings.test.ts tests/codex-inject.test.ts tests/codex-plugins-doctor.test.ts tests/release-notes.test.ts - - name: Run quality-gate Node suites - run: node --test .github/scripts/issue-quality.test.cjs .github/scripts/pr-quality.test.cjs - - name: Typecheck - run: bun run typecheck - - name: Check branch diff - run: git diff --check origin/dev...HEAD - - name: Commit fix and remove temporary workflow - shell: bash - run: | - set -euo pipefail - rm .github/workflows/tmp-fix-coderabbit-1750-quote.yml - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add src/codex/plugins-doctor.ts tests/codex-plugins-doctor.test.ts .github/workflows/tmp-fix-coderabbit-1750-quote.yml - git commit -m "fix: reject malformed quoted marketplace values" - git push origin HEAD:agent/codeql-real-findings-20260815 diff --git a/src/codex/plugins-doctor.ts b/src/codex/plugins-doctor.ts index d73a9c7506..3a58b47c3d 100644 --- a/src/codex/plugins-doctor.ts +++ b/src/codex/plugins-doctor.ts @@ -59,7 +59,7 @@ function readMarketplaceTable(configText: string, name: string): Record { } }, 2_000); + test("unterminated quoted values are rejected instead of parsed as bare values", () => { + const { dir, configPath } = makeConfig( + `[marketplaces.openai-bundled]\nsource_type = "local"\nsource = "unterminated\n`, + ); + try { + const result = diagnoseCodexBundledPlugins({ + platform: "win32", + configPath, + locateCurrent: () => null, + }); + expect(result.applicable).toBe(true); + if (result.applicable) { + expect(result.marketplace.sourceType).toBe("local"); + expect(result.marketplace.source).toBeNull(); + expect(result.stale).toBe(false); + expect(result.suggestedRepair).toBeNull(); + } + } finally { + rmSync(dir, { recursive: true, force: true }); + } + }); + test("parses a table header with a trailing inline comment", () => { const { dir, configPath } = makeConfig( `[marketplaces.openai-bundled] # bundled\nsource_type = "local"\nsource = "X:\\\\gone"\n`, From e689acb14d3c31195a1ca62be5cc7475f44c7afa Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sun, 16 Aug 2026 09:20:31 +0900 Subject: [PATCH 34/35] fix(quality-gates): strip HTML comments outside code, not through it GFM treats fenced-code contents as literal text, so a `|$)/g, "") + .replace(/\u0000F(\d+)\u0000/g, (_, i) => fences[Number(i)] ?? ""); +} + /** * Strip HTML comments, placeholder-only values, and trim whitespace. */ function clean(raw) { if (typeof raw !== "string") return ""; - let s = raw.replace(/|$)/g, ""); + // Comment stripping must not reach inside fenced code. GFM treats fence + // contents as literal text, so a `").trim(), ""); + }); +}); diff --git a/.github/scripts/pr-quality.cjs b/.github/scripts/pr-quality.cjs index b36283de2e..32e0500c44 100644 --- a/.github/scripts/pr-quality.cjs +++ b/.github/scripts/pr-quality.cjs @@ -245,7 +245,13 @@ function hasGuiOverride({ comments = [] }) { * fenced code blocks. Image syntax there is literal text, not evidence. */ function stripNonRenderedRegions(body) { - return body.replace(HTML_COMMENT_RE, "").replace(FENCED_CODE_RE, ""); + // Fenced code MUST be removed first. GFM treats fence contents as literal + // text, so a `"].join("\n"); + assert.equal(hasScreenshotEvidence(body), false); + }); +}); From bd886240b2e3dd4d8f1021d67df5758f7eb14b6a Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Sun, 16 Aug 2026 09:47:58 +0900 Subject: [PATCH 35/35] fix(issue-quality): replace the regex code-masker with a linear scanner Re-review found the first fix both incomplete and dangerous. DANGEROUS: the masker combined a variable-length delimiter capture, a lazy whole-input scan and a backreference, which backtracks catastrophically. A 60,488-character template-shaped body took 10.5s - inside an issue-automation trust boundary anyone can post to. Measured now: 60k unclosed fence 0ms, 20k inline spans 4ms. INCOMPLETE: it required the closing fence to match the opener's length exactly and only masked single-line code spans. GFM allows a LONGER closing fence and allows line endings inside a code span, so both cases still let a comment-like literal run to EOF and swallow the visible section below it. Replaced with a single-pass scanner that walks the string once: fenced blocks (<=3 space indent, >=3 backticks or tildes, closing run of at least the opening length), inline spans (a run of N backticks closed by the next run of exactly N), and HTML comments outside both. Also removed a duplicate definition of the function that the previous patch left behind - the stale regex copy was the one actually being called, which is why the longer-fence case still failed after the first attempt. Regressions: longer closing fence, multiline code span, and a bounded-time assertion on adversarial input. 193 pass; reverting the source fails 1. --- .github/scripts/issue-quality-core.cjs | 118 ++++++++++++++++++++++--- .github/scripts/issue-quality.test.cjs | 26 ++++++ 2 files changed, 131 insertions(+), 13 deletions(-) diff --git a/.github/scripts/issue-quality-core.cjs b/.github/scripts/issue-quality-core.cjs index b30ba6f0db..8b3c1efb9b 100644 --- a/.github/scripts/issue-quality-core.cjs +++ b/.github/scripts/issue-quality-core.cjs @@ -423,21 +423,113 @@ function isMediaOnly(text) { * Strip HTML comments, placeholder-only values, and trim whitespace. */ function stripHtmlCommentsOutsideCode(raw) { - const fences = []; - // Mask fenced blocks and inline code spans, strip comments from what is left, - // then restore. GitHub renders neither region as HTML, so a comment opener - // inside them is literal text -- but the text itself is real content. - const masked = String(raw) - .replace( - /(?:^|\n)[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?^[ \t]*\1[ \t]*(?=\n|$)/gm, - (block) => `\u0000F${fences.push(block) - 1}\u0000`, - ) - .replace(/`[^`\n]*`/g, (span) => `\u0000F${fences.push(span) - 1}\u0000`); - return masked - .replace(/|$)/g, "") - .replace(/\u0000F(\d+)\u0000/g, (_, i) => fences[Number(i)] ?? ""); + const text = String(raw); + // Linear scanner, deliberately not a regex. The previous masker combined a + // variable-length delimiter capture, a lazy whole-input scan and a + // backreference, which backtracks catastrophically on adversarial input: a + // 60k-character issue body took ~10.5s, inside an automation trust boundary + // that anyone can post to. This walks the string once. + // + // It also fixes two GFM cases the regex got wrong: a closing fence may be + // LONGER than its opener, and a code span may contain a line ending. + let out = ""; + let i = 0; + let atLineStart = true; + + const lineEnd = (from) => { + const nl = text.indexOf("\n", from); + return nl === -1 ? text.length : nl; + }; + + while (i < text.length) { + const ch = text[i]; + + // Fenced block: at most three leading spaces, then >= 3 backticks or tildes. + if (atLineStart && (ch === "`" || ch === "~" || ch === " " || ch === "\t")) { + let j = i; + let indent = 0; + while (j < text.length && (text[j] === " " || text[j] === "\t") && indent < 4) { j++; indent++; } + const marker = text[j]; + if (indent < 4 && (marker === "`" || marker === "~")) { + let run = 0; + while (text[j + run] === marker) run++; + if (run >= 3) { + // Copy the opening line verbatim, then everything up to a closing + // fence of the SAME character and AT LEAST the same length. + // `cursor` is the index of the newline ending the current line, so the + // next line starts at cursor + 1. + let cursor = lineEnd(j + run); + let closed = false; + while (cursor < text.length) { + const start = cursor + 1; + let p = start; + let ind = 0; + while (p < text.length && (text[p] === " " || text[p] === "\t") && ind < 4) { p++; ind++; } + let closeRun = 0; + while (text[p + closeRun] === marker) closeRun++; + const after = p + closeRun; + const rest = text.slice(after, lineEnd(after)); + if (ind < 4 && closeRun >= run && rest.trim() === "") { + const end = lineEnd(after); + out += text.slice(i, end); + i = end; + closed = true; + break; + } + const next = lineEnd(start); + if (next <= cursor) break; + cursor = next; + } + if (closed) { atLineStart = true; continue; } + // Unclosed fence runs to end of input, per GFM. + out += text.slice(i); + return out; + } + } + } + + // Inline code span: a run of N backticks closed by the next run of exactly N. + if (ch === "`") { + let run = 0; + while (text[i + run] === "`") run++; + let p = i + run; + let close = -1; + while (p < text.length) { + if (text[p] === "`") { + let r = 0; + while (text[p + r] === "`") r++; + if (r === run) { close = p + r; break; } + p += r; + continue; + } + p++; + } + if (close !== -1) { + out += text.slice(i, close); + atLineStart = false; + i = close; + continue; + } + } + + // HTML comment outside any code region. An unclosed one runs to EOF. + if (ch === "<" && text.startsWith("", i + 4); + if (end === -1) return out; + i = end + 3; + continue; + } + + out += ch; + atLineStart = ch === "\n"; + i++; + } + return out; } +/** + * Strip HTML comments, placeholder-only values, and trim whitespace. + */ /** * Strip HTML comments, placeholder-only values, and trim whitespace. */ diff --git a/.github/scripts/issue-quality.test.cjs b/.github/scripts/issue-quality.test.cjs index e74665c23c..028f9fdb60 100644 --- a/.github/scripts/issue-quality.test.cjs +++ b/.github/scripts/issue-quality.test.cjs @@ -2115,3 +2115,29 @@ describe("clean() respects fenced code (regression)", () => { assert.equal(clean("").trim(), ""); }); }); + +describe("code-region scanning is GFM-correct and linear (regression)", () => { + it("honors a closing fence longer than its opener", () => { + // GFM allows the closing fence to be longer. Requiring an exact-length + // match left the block unterminated, so the comment inside it ran to EOF + // and swallowed the visible section below. + const goal = ["```html", "