Skip to content

Release/3.4.0#410

Merged
bao-byterover merged 3 commits intomainfrom
release/3.4.0
Apr 14, 2026
Merged

Release/3.4.0#410
bao-byterover merged 3 commits intomainfrom
release/3.4.0

Conversation

@bao-byterover
Copy link
Copy Markdown
Collaborator

Summary

  • Problem: 3.4.0's scope (unified memory swarm + several hardening/security/docs fixes) has landed incrementally on main, but there is no tagged release yet — package.json still reports 3.3.0, CHANGELOG.md has no [3.4.0] entry, and CLAUDE.md architecture docs do not mention the new swarm module.
  • Why it matters: this merge + subsequent tag is what publishes 3.4.0 to users. Without it, brv --version drifts from shipped behavior, release tooling cannot cut the tag, and contributor onboarding docs miss the new swarm subsystem entirely.
  • What changed: consolidates everything shipped since v3.3.0brv swarm (onboard/status/query/curate) with adapters for ByteRover, Obsidian, local-markdown, GBrain, and OpenClaw Memory Wiki; agent swarm_query / swarm_store tools with sandbox SDK integration; swarm system-prompt contributor; user-configurable enrichment topology with cycle/self-edge validation; 5-tier search precision pipeline; RRF merging; short-lived result cache; transparent --explain output; ByteRover write fallback; auto-sync of context-tree .gitignore on brv vc; stale-location cleanup; axios pinned to 1.15.0 (security); gpt-5.4-mini added to Codex allowed models; tightened PR auto-review author associations; CODEOWNERS; dead-code removal; SKILL.md swarm docs; plus the 3.4.0 release-prep commits (version bump, CHANGELOG, CLAUDE.md).
  • What did NOT change (scope boundary): no database/storage format changes; no transport/daemon protocol break; no TUI feature directory added (swarm is CLI-only through oclif); no existing provider behavior altered outside the documented fixes (stale locations, .gitignore sync, axios pin); no changes to authentication, billing, or cloud-sync surfaces.

Type of change

  • Bug fix
  • New feature
  • Refactor (no behavior change)
  • Documentation
  • Test
  • Chore (build, dependencies, CI)

Scope (select all touched areas)

  • TUI / REPL
  • Agent / Tools
  • LLM Providers
  • Server / Daemon
  • Shared (constants, types, transport events)
  • CLI Commands (oclif)
  • Hub / Connectors
  • Cloud Sync
  • CI/CD / Infra

Linked issues

Root cause (bug fixes only, otherwise write N/A)

  • Root cause:
    • ENG-2050 (.gitignore auto-sync): initial context-tree .gitignore was only written at init time, so patterns added in later CLI versions never reached existing projects; derived artifacts then polluted brv vc diffs.
    • ENG-1610 (stale locations): knowledge entries whose source files were deleted were never cleaned up, leaving dead references in search/query.
    • ENG-2038 (axios): axios < 1.15.0 contained a critical security vulnerability; the unpinned minor let upgrades regress.
    • ENG-2078 (review defaults): confidence/impact were required on review outputs; missing fields crashed the reviewer with no safe fallback.
  • Why this was not caught earlier:
    • .gitignore behavior is only visible on long-lived projects created before the pattern changes — no prior test asserted re-sync on upgrade.
    • Stale-location cleanup was assumed to happen during re-index, but the code path deleted source files never re-ran expansion.
    • axios pinning was an explicit security-advisory response, not a test gap.
    • Reviewer-output tests asserted happy-path shapes only, not missing-field tolerance.

Test plan

  • Coverage added:
    • Unit test
    • Integration test
    • Manual verification only
  • Test file(s):
    • test/unit/agent/swarm/** (swarm-coordinator, swarm-graph, swarm-merger, swarm-router, swarm-write-router, search-precision, provider-factory, config loader/schema, validation, wizard, CLI renderer, system-prompt contributor)
    • test/unit/agent/swarm/adapters/** (byterover, gbrain, local-markdown, obsidian, memory-wiki)
    • test/unit/agent/swarm/tools/{swarm-query-tool,swarm-store-tool}.test.ts
    • test/unit/agent/sandbox/tools-sdk-swarm.test.ts
    • test/unit/agent/core/domain/swarm/types.test.ts
    • test/unit/agent/tools/curate-tool.test.ts
    • test/unit/utils/gitignore.test.ts (ENG-2050 auto-sync)
    • test/unit/server/infra/transport/handlers/{locations-handler,vc-handler}.test.ts (ENG-1610)
    • test/unit/infra/project/project-registry.test.ts
    • test/commands/swarm/{onboard,status,query,curate}.test.ts
  • Key scenario(s) covered:
    • Swarm: query routing, RRF merging, enrichment DAG validation (cycles, self-edges, disabled-provider warnings), write-router fallback to ByteRover, adapter health checks, wizard scaffolding, --explain output, result cache TTL.
    • gitignore auto-sync: missing patterns appended on subsequent brv vc runs without clobbering user entries.
    • Stale locations: entries referencing deleted files are pruned on next scan.
    • Security: axios resolves to 1.15.0 in package-lock.json.
    • gpt-5.4-mini: appears in Codex allowed-models list.

User-visible changes

  • New command group brv swarm (onboard, status, query, curate) — see CHANGELOG [3.4.0] for the full behavior surface.
  • brv swarm query and brv swarm curate now usable from the agent as swarm_query / swarm_store tools and from sandboxed code as tools.swarmQuery() / tools.swarmStore().
  • brv --version will report 3.4.0 after tag/publish.
  • Codex provider accepts gpt-5.4-mini.
  • Context-tree .gitignore now auto-heals on any brv vc command; previously-init'd projects pick up new patterns on upgrade.
  • Search/query no longer surface dead references to deleted source files.
  • Defaults only — no breaking flag or output-format changes.

Evidence

  • Failing test/log before + passing after (new suites under test/unit/agent/swarm/** all green)
  • Trace/log snippets (swarm --explain reasoning visible in query-renderer tests)
  • Screenshot/recording

git diff --stat v3.3.0..release/3.4.0 summary: 94 files changed, +12,031 / −217 lines, including ~20 new src/agent/infra/swarm/** modules, 4 oclif commands under src/oclif/commands/swarm/, 2 agent tool implementations + .txt definitions, and matching test suites.

git log --oneline main..release/3.4.0 (release-prep only, on top of the feature work already on main):

4093b92b chore: update CHANGELOG.md
4aa42287 chore: update CLAUDE.md
2800f889 chore: Bump version to 3.4.0

Checklist

  • Tests added or updated and passing (npm test)
  • Lint passes (npm run lint)
  • Type check passes (npm run typecheck)
  • Build succeeds (npm run build)
  • Commits follow Conventional Commits format
  • Documentation updated (CHANGELOG.md, CLAUDE.md, src/server/templates/skill/SKILL.md)
  • No breaking changes (or clearly documented above)
  • Branch is up to date with main (3 release-prep commits ahead, 0 behind)

Risks and mitigations

  • Risk: Swarm adapters (Obsidian / local-markdown / Memory Wiki) touch user filesystem paths outside the context tree; a misconfigured swarm.config.yaml could read/write the wrong directory.
    • Mitigation: brv swarm onboard wizard validates each provider's root path before writing config; brv swarm status performs pre-flight health checks; config validator rejects cycles/self-edges and warns on disabled providers.
  • Risk: Memory Wiki YAML content from untrusted sources could attempt YAML injection.
    • Mitigation: memory-wiki adapter hardened against YAML injection in ce4a23b4 with dedicated regression tests.
  • Risk: axios pin to 1.15.0 could conflict with transitive dependents expecting a newer minor.
    • Mitigation: package-lock.json regenerated and full test suite green; transitive axios users in the tree are compatible with 1.15.x.
  • Risk: .gitignore auto-sync could append patterns a user intentionally removed.
    • Mitigation: sync only appends missing patterns — it never rewrites or removes existing lines; covered by test/unit/utils/gitignore.test.ts.
  • Risk: Tagging from the merge commit while main is still advancing could race with late merges.
    • Mitigation: cut v3.4.0 immediately after this PR merges, before accepting further non-critical PRs; freeze window is short.

@bao-byterover bao-byterover requested a review from leehpham as a code owner April 14, 2026 13:40
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 14, 2026

Claude finished @bao-byterover's task in 3m 2s —— View job


PR Review: Release/3.4.0

Tasks:

  • Gather context and read changed files
  • Review CHANGELOG.md changes
  • Review CLAUDE.md changes
  • Review package.json changes
  • Post inline comments
  • Post final review with score

Overall Assessment: 5/5

This is a clean, correctly-scoped release-prep PR. All 3 commits are metadata-only (version bump, CHANGELOG, architecture docs) — the feature work is already merged to main. The changes are accurate, consistent with prior release patterns, and introduce no logic or behaviour changes.


Summary by File

package.json — Single-line 3.3.03.4.0 bump. Straightforward and correct. Axios is already pinned to 1.15.0 in dependencies, consistent with the security fix documented in CHANGELOG. ✓

CHANGELOG.md — New [3.4.0] section follows the same header-only format used by [3.3.0] (no date; consistent with project convention). Added/Fixed entries cover all user-visible surface areas called out in the PR body. Three minor notes posted inline:

  1. The brv swarm bullet is a dense single paragraph — splitting into sub-bullets per sub-command would help users scan it. (inline suggestion)
  2. Model name should use the literal identifier gpt-5.4-mini rather than GPT-5.4 Mini to match what users type in config. (inline)
  3. ENG-2078 (reviewer crash on missing confidence/impact fields) is documented in the PR body as a bug fix but has no CHANGELOG entry — if user-visible, it warrants a one-liner. (inline)

CLAUDE.md — Swarm module documentation is accurate and well-structured. Module counts (agent/infra/ 22→23, oclif/ adds swarm/) are consistent with the feature scope described in the PR. New ### Swarm section provides good navigational detail for contributors. One maintainability nit: the tool categories line is now a 14-item comma-separated run and will be hard to scan as it grows further. (inline)


Security Note

The axios pin to 1.15.0 is correctly reflected in both package.json (exact version, not ^) and CHANGELOG (Fixed). The PR body's risk analysis (transitive compatibility verified via full test suite) is appropriate.


All inline comments are non-blocking suggestions. This PR is ready to merge.

Comment thread CHANGELOG.md
## [3.4.0]

### Added
- **`brv swarm` — unified memory swarm** — Connect multiple memory providers (ByteRover context tree, Obsidian vaults, local markdown folders, GBrain, OpenClaw Memory Wiki) into a single query and storage layer. `brv swarm onboard` walks through an interactive setup wizard; `brv swarm status` shows provider health, write targets, and enrichment topology. `brv swarm query <question>` runs intelligent routing, parallel provider execution, and Reciprocal Rank Fusion merging — add `--explain` for classification reasoning and provider selection details. `brv swarm curate <content>` stores to the best writable provider based on content classification (`--provider` to override), falling back to ByteRover context-tree curation when no external target is available. Control how providers feed context to each other via `enrichment.edges` in `swarm.config.yaml` — the engine validates cycles, self-edges, and missing providers, and disabled-provider edges produce warnings instead of errors so partial setups degrade gracefully. The agent also gains `swarm_query` and `swarm_store` tools, and sandboxed code can call `tools.swarmQuery()` / `tools.swarmStore()`.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion (readability): The brv swarm Added bullet is a dense single-paragraph covering 7+ distinct user-facing features (onboard, status, query with --explain, curate with fallback, enrichment topology, agent tools, sandbox SDK). Consider splitting into sub-bullets per sub-command so readers can scan what's relevant to them. Even just:

- **`brv swarm` — unified memory swarm**
  - `brv swarm onboard` — interactive wizard to configure providers (ByteRover, Obsidian, GBrain, local-markdown, Memory Wiki)
  - `brv swarm status` — pre-flight health check and topology view
  - `brv swarm query <question>` — RRF-fused parallel search; `--explain` shows routing reasoning
  - `brv swarm curate <content>` — routes writes to best provider; `--provider` to override; falls back to ByteRover context-tree
  - Enrichment topology via `enrichment.edges` in `swarm.config.yaml` — validates cycles, self-edges, and disabled providers
  - Agent tools: `swarm_query` / `swarm_store`; sandbox SDK: `tools.swarmQuery()` / `tools.swarmStore()`

Comment thread CHANGELOG.md

### Added
- **`brv swarm` — unified memory swarm** — Connect multiple memory providers (ByteRover context tree, Obsidian vaults, local markdown folders, GBrain, OpenClaw Memory Wiki) into a single query and storage layer. `brv swarm onboard` walks through an interactive setup wizard; `brv swarm status` shows provider health, write targets, and enrichment topology. `brv swarm query <question>` runs intelligent routing, parallel provider execution, and Reciprocal Rank Fusion merging — add `--explain` for classification reasoning and provider selection details. `brv swarm curate <content>` stores to the best writable provider based on content classification (`--provider` to override), falling back to ByteRover context-tree curation when no external target is available. Control how providers feed context to each other via `enrichment.edges` in `swarm.config.yaml` — the engine validates cycles, self-edges, and missing providers, and disabled-provider edges produce warnings instead of errors so partial setups degrade gracefully. The agent also gains `swarm_query` and `swarm_store` tools, and sandboxed code can call `tools.swarmQuery()` / `tools.swarmStore()`.
- **GPT-5.4 Mini support** — Added `gpt-5.4-mini` to the Codex allowed models list.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit (model name consistency): CHANGELOG says GPT-5.4 Mini but the identifier users will encounter in config/docs is gpt-5.4-mini. Recommend matching the literal model string:

Suggested change
- **GPT-5.4 Mini support** — Added `gpt-5.4-mini` to the Codex allowed models list.
- **`gpt-5.4-mini` support** — Added `gpt-5.4-mini` to the Codex allowed models list.

Comment thread CHANGELOG.md
### Fixed
- **Context-tree `.gitignore` auto-sync** — The context-tree `.gitignore` now stays up to date automatically. When any `brv vc` command runs, missing patterns are appended to the existing file instead of only being written on first init. This prevents derived artifacts from polluting `brv vc` diffs after CLI updates.
- **Stale knowledge locations** — Knowledge entries whose source files were deleted are now cleaned up, preventing dead references in search and query results.
- **Security dependency update** — Pinned axios to 1.15.0 to address a critical vulnerability.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit (missing fix entry): ENG-2078 (tightened PR auto-review author associations / missing-field tolerance for confidence/impact fields) is documented in the PR as a bug fix with a root cause, but it doesn't appear in this Fixed section. If the crash fix is user-visible (review commands no longer fail silently), it warrants a one-liner here even if the change is small.

@bao-byterover bao-byterover merged commit dae1436 into main Apr 14, 2026
9 checks passed
Comment thread CLAUDE.md
- Tool categories: file ops (read/write/glob/grep), knowledge (create/expand/search), memory (read/write/edit/delete/list), curate, code exec, map
- Tool categories: file ops (read/write/edit/glob/grep/list-dir), bash (exec/output), knowledge (create/expand/search), memory (read/write/edit/delete/list), swarm (query/store), todos (read/write), curate, code exec, batch, detect domains, kill process, search history
- LLM: 18 providers in `infra/llm/providers/`; 6 compression strategies in `infra/llm/context/compression/`
- System prompts: contributor pattern (XML sections) in `infra/system-prompt/`
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit (maintainability): The tool categories line has grown to 14+ comma-separated items in a single run: file ops (read/write/edit/glob/grep/list-dir), bash (exec/output), knowledge (...), memory (...), swarm (query/store), todos, curate, code exec, batch, detect domains, kill process, search history. Hard to scan and prone to drift. A short bullet list or table would be easier to maintain as the tool set grows — not a blocker for this release.

@bao-byterover bao-byterover deleted the release/3.4.0 branch April 14, 2026 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant