Redact mount WebSocket credentials and add two-machine collaboration proof - #377
Conversation
|
Warning Review limit reached
Next review available in: 45 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (7)
📝 WalkthroughWalkthroughAdds a reusable realtime-collaboration fixture, WebSocket credential redaction, mount-latency measurement tooling, agent runbooks, and detailed collaboration evidence and trajectory records. ChangesRealtime collaboration validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Relayfile Eval ReviewRun: Passed: 4 | Needs human: 0 | Reviewable: 0 | Missing output: 0 | Failed: 0 | Skipped: 0 Human Review CasesNo reviewable human-review cases captured Relayfile output. |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.trajectories/completed/2026-07/traj_snj7hxsnw561.json:
- Line 149: Update the committed trajectory’s projectId value to remove the
absolute local path and username, using either an omitted field or a
repository-relative project slug instead.
In `@docs/evidence/real-time-collaboration-2026-07-26/README.md`:
- Line 73: Update the “Concurrent, interdependent work” evidence statement to
assign only BuildSHA and APIRevision to the backend, while attributing Region to
the frontend agent that rendered and tested it; preserve the existing
test-result details.
In `@scripts/measure-mount-latency.rb`:
- Around line 15-17: Update realtime_ns and the measurement flow in
scripts/measure-mount-latency.rb so reported one-way latency does not subtract
CLOCK_REALTIME timestamps from separate machines. Use a writer-side monotonic
round-trip/acknowledgment protocol, or record and apply a verified bounded clock
offset, then regenerate the evidence values using the corrected measurement.
- Around line 52-65: Update the probe collection flow around the until loop to
isolate each run with a nonce or fresh directory, ignore stale files, and accept
only sequences in 1..count. Track completion and deduplication by received
sequence number rather than file path, while preserving the existing CSV output
for valid current probes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 33e73d36-9090-4bc6-b9f0-4913a62e7e9e
⛔ Files ignored due to path filters (3)
docs/evidence/real-time-collaboration-2026-07-26/finn-to-sf-latency.csvis excluded by!**/*.csvdocs/evidence/real-time-collaboration-2026-07-26/mount-chaos-events.logis excluded by!**/*.logdocs/evidence/real-time-collaboration-2026-07-26/sf-to-finn-latency.csvis excluded by!**/*.csv
📒 Files selected for processing (21)
.trajectories/completed/2026-07/traj_snj7hxsnw561.json.trajectories/completed/2026-07/traj_snj7hxsnw561.md.trajectories/completed/2026-07/traj_snj7hxsnw561.trace.jsondocs/evidence/real-time-collaboration-2026-07-26/README.mddocs/evidence/real-time-collaboration-2026-07-26/backend-agent-prompt.txtdocs/evidence/real-time-collaboration-2026-07-26/frontend-agent-prompt.txtdocs/evidence/real-time-collaboration-2026-07-26/frontend-partition-prompt.txtdocs/evidence/real-time-collaboration-2026-07-26/frontend-restart-chaos-prompt.txtdocs/evidence/real-time-collaboration-2026-07-26/project-sha256.txtdocs/evidence/real-time-collaboration-2026-07-26/results.jsoninternal/mountsync/syncer.gointernal/mountsync/syncer_test.goscripts/measure-mount-latency.rbtestdata/realtime-collaboration/README.mdtestdata/realtime-collaboration/cmd/demo/main.gotestdata/realtime-collaboration/go.modtestdata/realtime-collaboration/internal/backend/status.gotestdata/realtime-collaboration/internal/backend/status_test.gotestdata/realtime-collaboration/internal/frontend/view.gotestdata/realtime-collaboration/internal/frontend/view_test.gotestdata/realtime-collaboration/internal/model/status.go
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9718cf1a80
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| until seen.length == count | ||
| Dir.glob(File.join(directory, "#{prefix}-*.probe")).sort.each do |path| | ||
| next if seen[path] |
There was a problem hiding this comment.
When receive is rerun with a prefix that already exists in the mount, this path immediately counts the old files as newly propagated samples because seen starts empty and is keyed only by pathname. If the stale count equals COUNT, the command exits with fabricated latency data before the writer runs; if it exceeds COUNT, seen.length can never equal count and the receiver times out. Ignore files that predate receiver startup or require and validate a unique run identifier.
Useful? React with 👍 / 👎.
| | sf → finn | 12 | 119.548 ms | 156.951 ms | 168.487 ms | 216.512 ms | | ||
| | finn → sf | 12 | 199.368 ms | 214.277 ms | 222.967 ms | 253.959 ms | |
There was a problem hiding this comment.
For these 12-sample datasets, the reported medians incorrectly select only the lower central value. The raw CSVs give (156.951 + 167.760) / 2 = 162.356 ms for sf → finn and (214.277 + 215.101) / 2 = 214.689 ms for finn → sf, rather than 156.951 ms and 214.277 ms; results.json repeats the same incorrect figures, so the committed performance evidence is internally inconsistent.
Useful? React with 👍 / 👎.
2 participants
What changed
token,access_token, andapi_keyquery values from mount-sync logs and returned WebSocket dial errorsWhy
A real concurrent relayfile exercise between
sf-mac-miniandfinn-mac-miniproved interdependent agent work, same-type overlap,mount-restart recovery, offline outbox replay after a real Tailscale transport
partition, and byte-identical convergence. During the partition, the failed Go
WebSocket dial error included the full authenticated URL and exposed the
workspace bearer token in mount logs.
The first logger-only repair passed unit tests but failed a live replay because
relayfile-mountlogs the returned maintenance error outsideSyncer. Thefinal fix redacts both the fully formatted Syncer log line and
webSocketDialError.Error, while retaining the original wrapped error forclassification.
User impact
Mount connection failures no longer place WebSocket credentials in logs. The
evidence directory provides reproducible, machine-readable proof of the
two-physical-machine collaboration run.
Real-hardware result
survived in the outbox and replayed after reconnect
artifacts
machine's monotonic clock: median 315.526 ms from sf and 373.230 ms from finn
[REDACTED]markers,identical deployed binary hashes
Full report:
docs/evidence/real-time-collaboration-2026-07-26/README.mdReview fixes
round trips and reran all 24 samples on a fresh real two-machine mount
acknowledgments
trajectory metadata
Validation
go test -race ./...go test ./...after review fixesgo vet ./...scripts/check-contract-surface.shgo test ./...insidetestdata/realtime-collaborationchecks for evidence artifacts
the secret-count assertion