fix(workbench): confine inventories and snapshots to the selected target - #472
fix(workbench): confine inventories and snapshots to the selected target#472mldangelo-oai wants to merge 17 commits into
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review the current head, |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review commit |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mldangelo-oai
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9249639ad6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return False | ||
| candidate = parent | ||
| continue | ||
| return directory_is_within_target(candidate.resolve(strict=True), target) |
There was a problem hiding this comment.
When a local patch contains a staged or untracked broken symlink such as broken.py -> missing.py, lstat() succeeds but resolve(strict=True) raises FileNotFoundError; both diff inventory and rank-input generation convert that into a fatal “Could not inspect” error, preventing the entire scan even though their later branches already handle symlinks without reading their targets. Validate a broken link's unresolved destination or containing directory so an in-target link can proceed while destinations outside the selected target remain rejected.
AGENTS.md reference: sdk/typescript/AGENTS.md:L22-L23
Useful? React with 👍 / 👎.
1 participant
Summary
Keep changed-file inventories, ranking previews, and Git snapshots inside the
selected repository target. Live working-tree paths that escape through parent
links are blocked without dropping safe deleted, nested, or alias-equivalent
paths.
Changes
ranking previews, and Git snapshots.
full-file review, while preserving committed revision data and safe deleted
entries and omitting vanished non-deleted paths.
Unicode- and case-equivalent path spellings, and nonblocking progress
estimates.
fallbacks, nested checkouts, missing parents, filesystem aliases, and looped
resolution.
mainand advance both bundled-plugin version declarations to0.1.38.Testing
Exact head
9249639ad66448521317150ff2507f1868b516d1:suites: 21 passed, 2 expected platform skips, zero failures.
12345full suite: 1,580 passed, 30 skipped, zero failures.checks: passed.
public import, strict NodeNext consumer, CLI, all 111 bundled plugin files,
bundled Codex, and the nested worker.
actionable issues.
Risk and rollout
This intentionally makes local-patch inventory and ranking stop when a changed
entry's nearest existing path resolves outside the selected target. Revision
mode still reads committed blobs, and safe deleted, missing, nested, and
alias-equivalent paths keep their existing behavior. Snapshot digests reject
unsafe roots before Git or fallback traversal, while optional progress counts
remain nonblocking. The change adds no command, flag, environment variable,
dependency, or state migration.
Both bundled-plugin version declarations are
0.1.38. If anotherplugin-changing pull request lands first, refresh from
mainand update bothdeclarations together. This pull request does not publish or release a package.
Exact-head cross-platform CI and human approval remain required. Processing
continues without waiting for CI, and any exact-head failures will be handled
in the return sweep.
Public disclosure review
The branch, title, description, commits, seven-file pull request delta, comments,
logs, screenshots, attachments, and links were reviewed. Existing automated
review comments contain requester-only Codex report links and an access-gated
settings link, so the nonpublic-links attestation remains unchecked.