docs(changelog): v0.9.5 entry - #1088
Merged
Merged
Conversation
The v0.9.5 release PR (#1086) merged without a CHANGELOG entry because I mistakenly split it out. `CHANGELOG.md` is baked into the compiled binary at build time (`script/build.ts` embeds it as `OPENCODE_CHANGELOG`) and copied into every platform-specific npm package (`script/publish.ts`), so shipping v0.9.5 without this entry would give users an artifact whose embedded changelog stops at v0.9.4. Entry incorporates PM's release-notes feedback from the pre-release persona review: leads with the Windows grep fix (~16% of Windows users broken since v0.9.2, hard number from telemetry), collapses the welcome-panel two-round fix into a single bullet, includes the YOLO deny-rules-still-apply safety caveat, and files the three telemetry / instrumentation commits under Changed (observability) rather than Added (user-visible feature) so the release isn't overstated.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
full receipts (1 session)
orchestrator ·
|
📝 WalkthroughWalkthroughThe changelog adds the ChangesRelease surface validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge The previous suggestion (file-scoped Files Reviewed (2 files)
Previous Review Summaries (2 snapshots, latest commit c37889d)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit c37889d)Status: 1 Suggestion | Recommendation: Merge Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (2 files)
Previous review (commit 55a8b97)Status: No Issues Found | Recommendation: Merge Files Reviewed (1 file)
Reviewed by glm-5.2 · Input: 39.7K · Output: 6.9K · Cached: 486.6K Review guidance: REVIEW.md from base branch |
Per the release skill's Step 6, every release ships with an adversarial
test file under `test/skill/release-v{X}-adversarial.test.ts` — one per
release since v0.5.14. The v0.9.5 file was written but not committed;
adding it here so the release PR carries the intended coverage.
Categories per the skill (empty/null/undefined, boundary values, type
confusion, injection attacks, error propagation), applied to the v0.9.5
code surface:
- **Flag.truthyEnv:** 32KB env values, embedded null bytes, whitespace,
unknown keys — all must not enable and must not throw.
- **Telemetry.classifyProvider:** 10KB providerIDs, control characters,
JSON-stringified inputs, prototype keys (`__proto__` / `prototype` /
`hasOwnProperty` / `isPrototypeOf`), unusual modelID values — all
must fall through to "other" without leaking a raw id or extending
Object.
- **OnboardingTelemetry.claimEnvironmentScan:** empty / 10KB / path-shaped
/ SQL-shaped sessionIDs — idempotent and session-scoped; the composed
gate short-circuits correctly when the session was never marked.
- **redactPaths / countSampleContents:** empty input, 100KB input in <1s,
regex metacharacters in `extras`, user text already containing `<path>`,
fs symlink loops on `countSampleContents`.
- **buildCliContext / buildAuthorizeUrl:** base64url shape, `v=1` payload,
redirect / state encoding on hostile inputs (newlines, tabs, fragment
chars), fragment-goes-last invariant, graceful degradation when the
machine-id path is unreadable (payload valid, `machine_id` omitted).
22 tests, all pass locally. No `mock.module()`; real helpers, real fs
where needed, real `process.env` mutation with `beforeEach` /
`afterEach` snapshot-and-restore.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 25: Update the telemetry documentation link in the changelog entry to
reference docs/docs/reference/telemetry.md instead of
docs/reference/telemetry.md, leaving the surrounding telemetry description
unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Previous commit landed the adversarial file with three raw null bytes embedded in string literals meant to test null-byte handling. Git classified the file as binary because of them, showing `Bin 0 -> 13936 bytes` and 0 insertions/deletions on the diff — reviewers on the PR couldn't see the file contents. Runtime behavior of the tests is unchanged; the JS string `"true\x00"` compiles to the same "true"+NUL sequence as a literal 0x00 byte in the source, without tripping git's binary detector. 22/22 tests still pass after the escape.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/opencode/test/skill/release-v0.9.5-adversarial.test.ts`:
- Around line 217-225: Update the symlink setup in the test to skip only
recognized unsupported-symlink errors, rethrow all other failures, and change
the models assertion to require exactly zero while preserving the tables
assertion.
- Around line 175-180: Update the test “redactPaths handles a 100KB message in
reasonable time (< 1s)” to construct exactly 100,000 characters, removing the
performance.now timing measurement and elapsed-time assertion. Keep the test
focused on asserting the redaction output for the generated input.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4cec0fb7-85a3-4d30-8840-827d0cc90ea9
📒 Files selected for processing (1)
packages/opencode/test/skill/release-v0.9.5-adversarial.test.ts
Three inline findings, all valid, all small:
- **CHANGELOG.md:25** (coderabbit + cubic, both P3) — repo-relative
telemetry doc path was `docs/reference/telemetry.md`; the file
actually lives at `docs/docs/reference/telemetry.md` (content root is
`docs/` per `docs/mkdocs.yml`, published at `reference/telemetry/`
on the docs site). Fixed the path so a maintainer following the link
in the changelog finds the file.
- **adversarial.test.ts:180** (coderabbit) — the 100KB stress test used
`repeat(1000)` which is ~20KB, not 100KB as advertised, and asserted
a wall-clock `performance.now()` budget which is flaky under host
load / parallel test runners. Built exactly 100_000 characters via
`Math.ceil(100_000 / segment.length)` slicing, and dropped the
timing assertion — the test now proves only what it claims (redaction
shape survives large input).
- **adversarial.test.ts:225** (coderabbit) — the symlink-loop test had a
bare `catch { return }` that would swallow every setup failure into a
passing test, and `toBeGreaterThanOrEqual(0)` accepted incorrect
positive counts. Narrowed the catch to the one known unsupported-
symlink error class (`EPERM` on Windows without dev-mode), re-throw
everything else, and tightened the assertion to exact `.toBe(0)` —
a nonzero count would mean the helper is following the loop.
22/22 adversarial tests still pass after the changes.
Contributor
Author
Bot-review — all three findings fixed (
|
| Source | Finding | Fix |
|---|---|---|
coderabbit + cubic @ CHANGELOG.md:25 |
Telemetry doc path was docs/reference/telemetry.md — real path is docs/docs/reference/telemetry.md (content root is docs/ per docs/mkdocs.yml) |
Path corrected |
coderabbit @ adversarial.test.ts:180 |
repeat(1000) is ~20KB not 100KB as claimed; performance.now() assertion is flaky under host load |
Built exactly 100,000 chars via Math.ceil(100_000 / segment.length) slicing; dropped the wall-clock assertion |
coderabbit @ adversarial.test.ts:225 |
Bare catch { return } swallows every setup failure into a passing test; toBeGreaterThanOrEqual(0) is trivially true |
Narrowed catch to EPERM (Windows without dev-mode), re-throw everything else; tightened assertion to exact .toBe(0) |
22/22 adversarial tests still pass locally. No must-fix findings from any bot; @kilo-code-bot returned "No Issues Found, Recommendation: Merge".
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| const OPT_OUT_VAR = "ALTIMATE_TELEMETRY_DISABLED" | ||
| let optOutSnapshot: string | undefined | ||
|
|
||
| beforeEach(() => { |
There was a problem hiding this comment.
SUGGESTION: These hooks are file-scoped but only the Flag.truthyEnv describe block mutates ALTIMATE_TELEMETRY_DISABLED.
beforeEach/afterEach (lines 35-41) run for all 22 tests in the file, yet only the Flag.truthyEnv adversarial block (line 43) ever sets ALTIMATE_TELEMETRY_DISABLED — the other four describe blocks don't touch it, so the snapshot/restore is a no-op for them. Moving OPT_OUT_VAR, optOutSnapshot, and both hooks inside that describe block would scope the env management to where it's actually needed and make the intent clearer.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Contributor
Author
There was a problem hiding this comment.
Applied in 3c0665d5 — moved OPT_OUT_VAR, optOutSnapshot, and both beforeEach / afterEach hooks inside the Flag.truthyEnv adversarial describe block. Scope now matches usage; 22/22 tests still pass locally. Thanks for the nit.
…eir describe block Kilo review on PR #1088: `beforeEach` / `afterEach` for the `ALTIMATE_TELEMETRY_DISABLED` env-var snapshot were declared at file scope, so they ran for all 22 tests even though only the four tests in `Flag.truthyEnv adversarial` ever set that variable. Moved the `const`, the `let`, and both hooks inside that describe block so scope matches usage. Behavior unchanged (still 22/22 pass); noise removed from unrelated tests' setup/teardown timeline.
ichandann
approved these changes
Aug 10, 2026
suryaiyer95
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Fixes the CHANGELOG gap from PR #1086 (merged into main as
5f51d651cc).Type of change
What does this PR do?
Adds the v0.9.5 entry to
CHANGELOG.md. The v0.9.5 release PR (#1086) merged without this — I mistakenly split CHANGELOG out of the release PR.CHANGELOG.mdis baked into the compiled binary at build time (script/build.tsembeds it asOPENCODE_CHANGELOG) and copied into every platform-specific npm package (script/publish.ts), so shipping v0.9.5 without this entry would give users an artifact whose embedded changelog stops at v0.9.4.Entry incorporates PM's release-notes feedback from the pre-release persona review:
~16%of Windows users,99 of 617 machinesfigure from telemetry)Ctrl+Yyank-conflict heads-upHow did you verify your code works?
Docs-only diff; no code change. Ran
bun turbo typechecklocally (13/13 workspaces green) as a sanity check that the file parses cleanly for the build'sBun.file(...).text()read.Screenshots / recordings
Not applicable — CHANGELOG.md text.
Checklist
🤖 Generated with Claude Code
https://claude.ai/code/session_01Q8FGy89Qpr39k8nCSpCcK2
Summary by cubic
Adds the v0.9.5 entry to
CHANGELOG.mdso the compiled binary (OPENCODE_CHANGELOGviascript/build.ts) and npm packages (script/publish.ts) embed the correct release notes (Windows grep fix, mid-session YOLO toggle, welcome panel sizing, telemetry updates). Also adds and hardens the v0.9.5 adversarial test (escape\x00, true 100KB redaction check, strict symlink-loop assertion) and fixes the changelog telemetry docs link; runtime behavior is unchanged.ALTIMATE_TELEMETRY_DISABLEDenv snapshot hooks to theFlag.truthyEnvdescribe block in the adversarial test to reduce unnecessary setup; all tests still pass.Written for commit 3c0665d. Summary will update on new commits.
Summary by CodeRabbit
New Features
Bug Fixes
grepsupport.