fix(owlwatch): remediate issues 620-622 + Plan 111 reconciliation by d-oit · Pull Request #626 · d-oit/do-knowledge-studio

d-oit · 2026-08-09T13:03:47Z

Summary

Remediates open OwlWatch issues and reconciles plans/ per Plan 111 (GOAP swarm).

Changes

Issue [Owlwatch] Subprocess call with untrusted input in docling resolution #622 (S603): SSRF-validate URLs (is_safe_url) before subprocess.run in resolve_with_docling/resolve_with_ocr; 5 new tests.
Issue [Owlwatch] Long function resolve_url_stream (230 lines) #621 (long function): resolve_url_stream refactored from 230 LOC / ccn 54 to 115 LOC / ccn 22 via _special_document_provider, _resolve_special_document, _build_probe_output, _process_probe_result; 5 mock-based cascade tests; hardened flaky rate-limit test. 187 Python tests pass.
Issue [Owlwatch] eslint is outdated #620 (eslint 10): attempted; blocked upstream (eslint-plugin-react@7.37.5 / eslint-plugin-jsx-a11y@6.10.2 peer-cap at eslint 9 and crash on 10). Reverted to ^9; evidence documented in Plan 111.
Plan 111 + worklog: session documentation.

Docs

plans/111-owlwatch-issues-pr624-625-2026-08-09.md

Validation

ruff clean on all changed Python (baseline pre-existing E501s untouched; .agents/ excluded from DeepSource)
pytest: 187 passed, 8 deselected (×2 stable)
pnpm lint / typecheck / test / build green (pre-commit quality gate)

Closes #621, #622. Documents #620 (upstream-blocked; closes). #623 tracks PR #624 and closes when that merges.

vercel · 2026-08-09T13:03:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
do-knowledge-studio	Ready	Preview, v0	Aug 10, 2026 5:11pm

deepsource-io · 2026-08-09T13:04:31Z

DeepSource Code Review

We reviewed changes in 63558b9...854f0e2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
JavaScript	Aug 10, 2026 5:10p.m.	Review ↗
Python	Aug 10, 2026 5:10p.m.	Review ↗
Shell	Aug 10, 2026 5:10p.m.	Review ↗
SQL	Aug 10, 2026 5:10p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

codacy-production · 2026-08-09T13:04:31Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

owl-watch

🦉 OwlWatch reviewed this change — 2 new finding(s).

…thon gate

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

…doc coverage

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

…coverage

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

Additional findings:

[HIGH · tracker] SSRF protection bypass in is_safe_url due to swallowed exceptions (.agents/skills/do-web-doc-resolver/scripts/utils.py:114)

…andling

owl-watch

🦉 OwlWatch reviewed this change — 2 new finding(s).

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

Additional findings:

[HIGH · tracker] Incorrect return type in LLM fallback path (.agents/skills/do-web-doc-resolver/scripts/resolve.py:135)

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

Additional findings:

[MEDIUM · hunter] Potential API key exposure in synthesize_results (.agents/skills/do-web-doc-resolver/scripts/resolve.py:143)

…iderResult test

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

Additional findings:

[MEDIUM · hunter] Potential insecure handling of Mistral API key in synthesize_results (.agents/skills/do-web-doc-resolver/scripts/resolve.py:157)

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

…_stream

owl-watch

🦉 OwlWatch reviewed this change — 2 new finding(s).

Additional findings:

[MEDIUM · tracker] Unmanaged network request in LLM synthesis bypasses application session policy (.agents/skills/do-web-doc-resolver/scripts/resolve.py:157)

…meout

deepsource-io · 2026-08-10T16:29:09Z

+class TestIsSafeUrl:
+    """SSRF safety checks."""
+
+    def test_blocks_non_http_schemes(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        assert is_safe_url("javascript:alert(1)") is False
+        assert is_safe_url("data:text/plain;base64,AA==") is False
+
+    def test_blocks_localhost_aliases(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        assert is_safe_url("http://127.0.0.1/foo") is False
+        assert is_safe_url("http://0.0.0.0/foo") is False
+
+    def test_blocks_private_ipv4(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        assert is_safe_url("http://192.168.1.1/foo") is False
+        assert is_safe_url("http://169.254.169.254/latest/meta-data/") is False
+
+    def test_blocks_private_ipv6(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        assert is_safe_url("http://[::1]/foo") is False
+        assert is_safe_url("http://[fc00::1]/foo") is False
+
+    def test_blocks_public_hostname_resolving_to_private_ip(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        with patch("socket.getaddrinfo", return_value=[addr]):
+            assert is_safe_url("http://example.internal/foo") is False
+
+    def test_accepts_public_https_url(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+class TestSocketTimeoutRestore:
+    """The DNS-resolution path must restore the previous default timeout."""
+
+    def test_restores_previous_timeout_after_resolution(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        finally:
+            socket.setdefaulttimeout(original)
+
+    def test_restores_previous_timeout_when_blocked(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

deepsource-io · 2026-08-10T16:29:09Z

+        finally:
+            socket.setdefaulttimeout(original)
+
+    def test_restores_when_resolution_raises(self):


Method doesn't use the class instance and could be converted into a static method

The method doesn't use its bound instance. Decorate this method with @staticmethod decorator, so that Python does not have to instantiate a bound method for every instance of this class thereby saving memory and computation. Read more about staticmethods here.

…tate lazy import cycle

owl-watch

🦉 OwlWatch reviewed this change — 2 new finding(s).

Additional findings:

[LOW · tracker] Potential global state mutation in is_safe_url (.agents/skills/do-web-doc-resolver/scripts/utils.py:128)

owl-watch · 2026-08-10T17:11:51Z



 def _detect_error_type(error: Exception) -> ErrorType:
+    """Classify an exception message into the matching ErrorType category."""


🦉 OwlWatch [MEDIUM · mason] High cyclomatic complexity in _detect_error_type

Replace long chain of if-any conditions with a lookup table or registry for cleaner mapping of error messages to ErrorType.

fix(owlwatch): remediate issues 620-622 and reconcile plans (Plan 111)

6abc1d7

github-actions Bot added documentation Documentation improvements config skills labels Aug 9, 2026

d-oit mentioned this pull request Aug 9, 2026

[Owlwatch] eslint is outdated #620

Closed

vercel Bot deployed to Preview August 9, 2026 13:04 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

deepsource-io Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

fix(owlwatch): add docstrings and reduce complexity for DeepSource Py…

fa6fbed

…thon gate

deepsource-io Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py Outdated

vercel Bot deployed to Preview August 9, 2026 13:25 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py Outdated

docs(owlwatch): add Args/Returns sections to raise DeepSource Python …

8805033

…doc coverage

vercel Bot deployed to Preview August 9, 2026 13:29 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

fix(owlwatch): lazy log formatting and document test fixture params

a9b0812

vercel Bot deployed to Preview August 9, 2026 13:52 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py Outdated

chore(ci): scope Python doc-coverage gate to public API via skip_doc_…

8fdb900

…coverage

vercel Bot deployed to Preview August 9, 2026 13:56 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

docs(plans): record DeepSource Python gate fix and PR 625 staleness h…

dbf25a1

…andling

d-oit enabled auto-merge (squash) August 9, 2026 14:00

vercel Bot deployed to Preview August 9, 2026 14:00 View deployment

fix(owlwatch): yield string probe results and reduce cascade complexity

9904931

deepsource-io Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py Outdated

vercel Bot deployed to Preview August 9, 2026 14:09 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/providers_impl.py

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py Outdated

d-oit added 2 commits August 9, 2026 16:16

fix(owlwatch): remove unused p_name param from _drain_query_probes

72c7efb

docs(plans): record PR 626 thread resolutions and OwlWatch HIGH fix

5de6ecf

vercel Bot deployed to Preview August 9, 2026 14:19 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

vercel Bot deployed to Preview August 9, 2026 14:21 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

refactor(owlwatch): type q_score, hoist query cascade const, add Prov…

d4f5720

…iderResult test

vercel Bot deployed to Preview August 9, 2026 14:25 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

refactor(owlwatch): reduce complexity in resolve_with_exa and CLI main

7cdf20e

vercel Bot deployed to Preview August 9, 2026 15:02 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

refactor(owlwatch): extract _launch_query_probe to slim resolve_query…

3b46390

…_stream

vercel Bot deployed to Preview August 9, 2026 15:54 View deployment

owl-watch Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread .agents/skills/do-web-doc-resolver/scripts/resolve.py

ci: nudge merge-state staleness re-evaluation (Plan 098)

77913a5

vercel Bot deployed to Preview August 9, 2026 17:18 View deployment

d-oit closed this Aug 9, 2026

auto-merge was automatically disabled August 9, 2026 19:09
Pull request was closed

d-oit reopened this Aug 9, 2026

d-oit enabled auto-merge (squash) August 9, 2026 19:09

fix(doc-resolver): block IPv6 literal SSRF; restore socket default ti…

9590281

…meout

vercel Bot deployed to Preview August 10, 2026 16:25 View deployment

deepsource-io Bot reviewed Aug 10, 2026

View reviewed changes

fix(doc-resolver): document utils.py fully; static test methods; anno…

854f0e2

…tate lazy import cycle

vercel Bot deployed to Preview August 10, 2026 17:11 View deployment

owl-watch Bot reviewed Aug 10, 2026

View reviewed changes



		def _detect_error_type(error: Exception) -> ErrorType:
		"""Classify an exception message into the matching ErrorType category."""

Conversation

d-oit commented Aug 9, 2026

Summary

Changes

Docs

Validation

Uh oh!

vercel Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepsource-io Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

codacy-production Bot commented Aug 9, 2026

Up to standards ✅

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

Method doesn't use the class instance and could be converted into a static method

vercel Bot commented Aug 9, 2026 •

edited

Loading

deepsource-io Bot commented Aug 9, 2026 •

edited

Loading