Skip to content

feat: add GitHub issue lifecycle runner#1334

Draft
legreffier[bot] wants to merge 15 commits into
mainfrom
issue-1327-build-github-issue-lifecycle-app
Draft

feat: add GitHub issue lifecycle runner#1334
legreffier[bot] wants to merge 15 commits into
mainfrom
issue-1327-build-github-issue-lifecycle-app

Conversation

@legreffier
Copy link
Copy Markdown
Contributor

@legreffier legreffier Bot commented Jun 6, 2026

Summary

Adds @themoltnet/issue-lifecycle, a concrete CLI app for driving the GitHub issue workflow from issue triage through planning, human approval, implementation, PR gate retry, release, and notification.

The app registers an Absurd durable task named github_issue_lifecycle and uses MoltNet freeform task continuations with correlation ids, references, and continueFrom so each agent loop can pick up the prior session/worktree context.

This also adds:

  • apps/issue-lifecycle/README.md covering the flow, task contract, CLI, retry/recovery model, manual e2e-stack smoke test, tests, and references
  • phase-specific input.successCriteria for generated lifecycle tasks, including parent task/attempt assertions for continuation outputs
  • real JSON CIDs for GitHub issue context references instead of synthetic gh:issue:* labels
  • dedicated issue-lifecycle-db and issue-lifecycle-db-migrate compose services that initialize the Absurd schema/queue for local and e2e testing
  • an AGENTS.md guard requiring activated-agent GitHub tokens for PR/issue/comment writes so future PRs are authored by the active agent instead of a human gh login

Testing

  • pnpm nx sync
  • pnpm exec nx run @themoltnet/issue-lifecycle:test
  • pnpm exec nx run @themoltnet/issue-lifecycle:typecheck
  • pnpm exec nx run @themoltnet/issue-lifecycle:lint
  • pnpm exec nx run @themoltnet/issue-lifecycle:build
  • pnpm exec nx run @themoltnet/issue-lifecycle:check:pack
  • pnpm exec nx run @moltnet/absurd-migrate-image:docker:build
  • docker compose -f docker-compose.e2e.yaml config issue-lifecycle-db issue-lifecycle-db-migrate
  • docker compose -f docker-compose.e2e.yaml -f docker-compose.e2e.ci.yaml config issue-lifecycle-db issue-lifecycle-db-migrate
  • COMPOSE_DISABLE_ENV_FILE=true docker compose -f docker-compose.e2e.yaml up -d --build issue-lifecycle-db-migrate
  • COMPOSE_DISABLE_ENV_FILE=true docker compose -f docker-compose.e2e.yaml up --build --force-recreate issue-lifecycle-db-migrate
  • ABSURD_DATABASE_URL=postgresql://issue_lifecycle:issue_lifecycle_secret@localhost:55434/issue_lifecycle uvx absurdctl list-queues
  • short local smoke: issue-lifecycle spawned an Absurd run on the dedicated DB and created a queued local triage freeform task for issue Build GitHub issue lifecycle app using freeform continuations #1327

Follow-up Manual Validation

Full daemon-backed manual smoke testing is still planned. The local stack path now reaches the first durable wait: Absurd owns the workflow run, the app creates the triage task in the local MoltNet task DB, and the run sleeps while waiting for an accepted daemon attempt. The remaining manual step is running apps/agent-daemon with model credentials to execute the generated freeform tasks.

Closes #1327.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 6, 2026

✅ CLI go.mod matches internal Go module releases

apps/moltnet-cli/go.mod is aligned with the versions tracked in .release-please-manifest.json.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 6, 2026

🚨 Dependency Audit — Vulnerabilities found

Full report
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Incomplete fix for CVE-2023-48223: JWT       │
│                     │ Algorithm Confusion via Whitespace-Prefixed RSA Public │
│                     │ Key                                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
│                     │                                                        │
│                     │ libs__auth>fast-jwt                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mvf2-f6gm-w987      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Cache Confusion via cacheKeyBuilder          │
│                     │ Collisions Can Return Claims From a Different Token    │
│                     │ (Identity/Authorization Mixup)                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=0.0.1 <6.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
│                     │                                                        │
│                     │ libs__auth>fast-jwt                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-rp9m-7r4c-75qg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ Arbitrary code execution in protobufjs                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <7.5.5                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xq3m-2v4x-88gg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ Arbitrary code execution in protobufjs                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.0.1                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xq3m-2v4x-88gg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: JWT auth bypass due to empty HMAC secret     │
│                     │ accepted by async key resolver                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.2.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
│                     │                                                        │
│                     │ libs__auth>fast-jwt                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-gmvf-9v4p-v8jc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-jwt accepts unknown `crit` header extensions (RFC │
│                     │ 7515 violation)                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
│                     │                                                        │
│                     │ libs__auth>fast-jwt                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm7r-c7qw-ghp6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Fastify has a Body Schema Validation Bypass via        │
│                     │ Leading Space in Content-Type Header                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fastify                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.3.2 <=5.8.4                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=5.8.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>fastify                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-247c-9743-5963      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to path traversal via              │
│                     │ percent-encoded dot segments                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=3.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>ajv>fast-uri  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q3j6-qgpj-74h6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to host confusion via              │
│                     │ percent-encoded authority delimiters                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=3.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>ajv>fast-uri  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v39h-62p7-jpjc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code injection through bytes field        │
│                     │ defaults in generated toObject code                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-66ff-xgx4-vchm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code injection through bytes field        │
│                     │ defaults in generated toObject code                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-66ff-xgx4-vchm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code generation gadget after prototype    │
│                     │ pollution                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-75px-5xx7-5xc7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code generation gadget after prototype    │
│                     │ pollution                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-75px-5xx7-5xc7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Process-wide denial of service through    │
│                     │ unsafe option paths                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jvwf-75h9-cwgg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Process-wide denial of service through    │
│                     │ unsafe option paths                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jvwf-75h9-cwgg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Denial of service through unbounded       │
│                     │ protobuf recursion                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-685m-2w69-288q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Denial of service through unbounded       │
│                     │ protobuf recursion                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-685m-2w69-288q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono missing validation of cookie name on write path   │
│                     │ in setCookie()                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.12                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.12                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-26pp-8wgv-hjvm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: Non-breaking space prefix bypass in cookie name  │
│                     │ handling in getCookie()                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.12                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.12                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r5rp-j6wh-rvv4      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: Path traversal in toSSG() allows writing files   │
│                     │ outside the output directory                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.0.0 <=4.12.11                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.12                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xf4j-xp2r-rqqx      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: Middleware bypass via repeated slashes in        │
│                     │ serveStatic                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.12                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.12                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-wmmm-f939-6g9c      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ @hono/node-server: Middleware bypass via repeated      │
│                     │ slashes in serveStatic                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @hono/node-server                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <1.19.13                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.19.13                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>@hono/node-   │
│                     │ server                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-92pp-h63x-v22m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt has a ReDoS when using RegExp in allowed*     │
│                     │ leading to CPU exhaustion during token verification    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0 <=6.2.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
│                     │                                                        │
│                     │ libs__auth>fast-jwt                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-cjw9-ghj4-fwxf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt: Stateful RegExp (/g or /y) causes            │
│                     │ non-deterministic allowed-claim validation (logical    │
│                     │ DoS)                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <6.2.1                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
│                     │                                                        │
│                     │ libs__auth>fast-jwt                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-3j8v-cgw4-2g6q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ hono Improperly Handles JSX Attribute Names Allows     │
│                     │ HTML Injection in hono/jsx SSR                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.14                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.14                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-458j-xx4x-4375      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono has incorrect IP matching in ipRestriction() for  │
│                     │ IPv4-mapped IPv6 addresses                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.12                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.12                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xpcf-pg52-r92g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono has CSS Declaration Injection via Style Object    │
│                     │ Values in JSX SSR                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.18                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.18                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-qp7p-654g-cw7p      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ ip-address has XSS in Address6 HTML-emitting methods   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ ip-address                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=10.1.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>express-rate- │
│                     │ limit>ip-address                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v2v4-37r5-5v8g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Denial of service from crafted field      │
│                     │ names in generated code                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2pr8-phx7-x9h3      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Denial of service from crafted field      │
│                     │ names in generated code                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2pr8-phx7-x9h3      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Prototype injection in generated message  │
│                     │ constructors                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fx83-v9x8-x52w      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Prototype injection in generated message  │
│                     │ constructors                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fx83-v9x8-x52w      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs has overlong UTF-8 decoding                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @protobufjs/utf8                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=1.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-                             │
│                     │ transformer>protobufjs>@protobufjs/utf8                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q6x5-8v7m-xcrf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs has overlong UTF-8 decoding                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q6x5-8v7m-xcrf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs has overlong UTF-8 decoding                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q6x5-8v7m-xcrf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono's Cache Middleware ignores Vary: Authorization /  │
│                     │ Vary: Cookie leading to cross-user cache leakage       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.18                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.18                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p77w-8qqv-26rm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: bodyLimit() can be bypassed for chunked /        │
│                     │ unknown-length requests                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.16                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.16                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-9vqf-7f2p-gf9v      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ hono/jsx has Unvalidated JSX Tag Names that May Allow  │
│                     │ HTML Injection                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.16                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.16                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-69xw-7hcm-h432      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ brace-expansion: Large numeric range defeats           │
│                     │ documented `max` DoS protection                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ brace-expansion                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0 <5.0.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=5.0.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/pi-coding-          │
│                     │ agent>minimatch>brace-expansion                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jxxr-4gwj-5jf2      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ ws: Uninitialized memory disclosure                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ ws                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.20.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.20.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/pi-ai>@google/      │
│                     │ genai>ws                                               │
│                     │                                                        │
│                     │ libs__database>@dbos-inc/dbos-sdk>ws                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-58qx-3vcg-4xpx      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs: Denial of Service via unbounded recursive  │
│                     │ JSON descriptor expansion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jggg-4jg4-v7c6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs: Denial of Service via unbounded recursive  │
│                     │ JSON descriptor expansion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=7.5.7                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.8                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/pi-ai>@google/      │
│                     │ genai>protobufjs                                       │
│                     │                                                        │
│                     │ apps__mcp-server>pino-opentelemetry-transport>otlp-    │
│                     │ logger>@opentelemetry/exporter-logs-otlp-grpc>@grpc/   │
│                     │ grpc-js>@grpc/proto-loader>protobufjs                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jggg-4jg4-v7c6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ uuid: Missing buffer bounds check in v3/v5/v6 when buf │
│                     │ is provided                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ uuid                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <11.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=11.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>mqemitter-      │
│                     │ redis>hyperid>uuid                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-w5hq-g745-h8pq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ qs has a remotely triggerable DoS: qs.stringify        │
│                     │ crashes with TypeError on null/undefined entries in    │
│                     │ comma-format arrays when encodeValuesOnly is set       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=6.11.1 <=6.15.1                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.15.2                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>express>qs    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q8mj-m7cp-5q26      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: IP Restriction bypasses static deny rules for    │
│                     │ non-canonical IPv6                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.21                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.21                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xrhx-7g5j-rcj5      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: Cookie helper does not sanitize sameSite and     │
│                     │ priority, allowing Set-Cookie injection                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.21                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.21                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-3hrh-pfw6-9m5x      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: JWT middleware accepts any Authorization scheme, │
│                     │ not only Bearer                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.21                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.21                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f577-qrjj-4474      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Hono: app.mount() strips mount prefix using undecoded  │
│                     │ path, causing incorrect routing for percent-encoded    │
│                     │ paths                                                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.21                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.21                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2gcr-mfcq-wcc3      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ Elliptic Uses a Cryptographic Primitive with a Risky   │
│                     │ Implementation                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ elliptic                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.6.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ libs__auth>get-jwks>jwk-to-pem>elliptic                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-848j-6mx2-7j84      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ Hono has improper validation of NumericDate claims     │
│                     │ (exp, nbf, iat) in JWT verify()                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ hono                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.12.18                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.12.18                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>hono          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm8q-7f3q-5f36      │
└─────────────────────┴────────────────────────────────────────────────────────┘
58 vulnerabilities found
Severity: 2 low | 35 moderate | 13 high | 8 critical

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 6, 2026

⚠️ Knip — Unused code or dependencies found

Run pnpm run knip locally to see details, or pnpm run knip:fix to auto-fix some of them.

Full report
�[93m�[4mUnused files�[24m�[39m (36)
.agents/skills/monitor-ci/scripts/ci-poll-decide.mjs                                       
.agents/skills/monitor-ci/scripts/ci-state-update.mjs                                      
apps/agent-daemon/src/node-sqlite.d.ts                                                     
apps/console/e2e/seed-diary-browser.ts                                                     
apps/landing/src/hooks/useFeedSSE.ts                                                       
apps/mcp-host/server.mjs                                                                   
apps/mcp-host/src/sandbox.ts                                                               
apps/mcp-server/src/schemas/index.ts                                                       
apps/rest-api/src/migrate.ts                                                               
apps/rest-api/src/sse/public-feed-poller.ts                                                
apps/rest-api/src/sse/sse-writer.ts                                                        
docs/.vitepress/env.d.ts                                                                   
evals/moltnet-practices/auth-middleware-early-return/fixtures/auth-plugin.ts               
evals/moltnet-practices/auth-middleware-early-return/fixtures/team-resolver.ts             
evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/sdk.gen.ts                    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/consolidate-workflow.ts    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/diary-entry.repository.ts  
evals/moltnet-practices/rest-error-boundary/fixtures/pack-routes.ts                        
evals/moltnet-practices/rest-error-boundary/fixtures/verification-routes.ts                
evals/moltnet-practices/webhook-auth-status-code/fixtures/hooks.ts                         
examples/diary-create.ts                                                                   
examples/diary-search.ts                                                                   
examples/register.ts                                                                       
examples/sign-entry.ts                                                                     
test-fixtures/generate-ssh-vectors.mjs                                                     
test-fixtures/generate-x25519-vectors.mjs                                                  
tools/db/backfill-content-hashes.ts                                                        
tools/db/backfill-diary-team-links.ts                                                      
tools/db/backfill-keto-subject-set.ts                                                      
tools/db/backfill-personal-teams.ts                                                        
tools/db/backfill-team-relations-plural.ts                                                 
tools/db/cleanup-legacy-diary-tuples.ts                                                    
tools/generators/split-tsconfigs/index.ts                                                  
tools/generators/split-tsconfigs/schema.d.ts                                               
tools/src/tasks/seed-judge-fixture.ts                                                      
tools/src/verify-task-context.ts                                                           
�[93m�[4mUnused dependencies�[24m�[39m (41)
@earendil-works/gondolin                     apps/agent-daemon/package.json:32:6        
pino-pretty                                  apps/agent-daemon/package.json:46:6        
@moltnet/models                              apps/console/package.json:11:6             
@moltnet/entry-explore-mcp-app               apps/mcp-server/package.json:30:6          
@themoltnet/design-system                    apps/mcp-server/package.json:34:6          
@fastify/otel                                apps/mcp-server/package.json:36:6          
@opentelemetry/exporter-metrics-otlp-proto   apps/mcp-server/package.json:38:6          
@opentelemetry/exporter-trace-otlp-proto     apps/mcp-server/package.json:39:6          
@opentelemetry/instrumentation               apps/mcp-server/package.json:40:6          
@opentelemetry/instrumentation-dns           apps/mcp-server/package.json:41:6          
@opentelemetry/instrumentation-http          apps/mcp-server/package.json:42:6          
@opentelemetry/instrumentation-net           apps/mcp-server/package.json:43:6          
@opentelemetry/instrumentation-pino          apps/mcp-server/package.json:44:6          
@opentelemetry/instrumentation-pg            apps/mcp-server/package.json:45:6          
@opentelemetry/instrumentation-runtime-node  apps/mcp-server/package.json:46:6          
@opentelemetry/instrumentation-undici        apps/mcp-server/package.json:47:6          
@opentelemetry/resources                     apps/mcp-server/package.json:48:6          
@opentelemetry/sdk-metrics                   apps/mcp-server/package.json:49:6          
@opentelemetry/sdk-trace-base                apps/mcp-server/package.json:50:6          
@opentelemetry/sdk-trace-node                apps/mcp-server/package.json:51:6          
@opentelemetry/semantic-conventions          apps/mcp-server/package.json:52:6          
pino                                         apps/mcp-server/package.json:56:6          
pino-opentelemetry-transport                 apps/mcp-server/package.json:57:6          
thread-stream                                apps/mcp-server/package.json:58:6          
multiformats                                 apps/rest-api/package.json:38:6            
@huggingface/transformers                    apps/rest-api/package.json:40:6            
@opentelemetry/exporter-metrics-otlp-proto   apps/rest-api/package.json:50:6            
@opentelemetry/instrumentation               apps/rest-api/package.json:52:6            
@opentelemetry/resources                     apps/rest-api/package.json:60:6            
@opentelemetry/sdk-metrics                   apps/rest-api/package.json:61:6            
@opentelemetry/sdk-trace-base                apps/rest-api/package.json:62:6            
@opentelemetry/sdk-trace-node                apps/rest-api/package.json:63:6            
@opentelemetry/semantic-conventions          apps/rest-api/package.json:64:6            
pino-pretty                                  apps/rest-api/package.json:73:6            
thread-stream                                apps/rest-api/package.json:74:6            
@noble/hashes                                libs/context-pack-service/package.json:19:6
tslib                                        package.json:158:6                         
@moltnet/auth                                tools/package.json:39:6                    
@moltnet/models                              tools/package.json:46:6                    
drizzle-orm                                  tools/package.json:54:6                    
fastq                                        tools/package.json:55:6                    
�[93m�[4mUnused devDependencies�[24m�[39m (21)
@moltnet/database           apps/console/package.json:23:6              
@moltnet/bootstrap          apps/mcp-server/package.json:61:6           
@moltnet/database           apps/mcp-server/package.json:62:6           
drizzle-orm                 apps/mcp-server/package.json:65:6           
pino-pretty                 apps/mcp-server/package.json:66:6           
vitest                      libs/bootstrap/package.json:24:6            
@moltnet/crypto-service     libs/context-distill/package.json:17:6      
@moltnet/database           libs/context-distill/package.json:18:6      
@testcontainers/postgresql  libs/context-distill/package.json:19:6      
drizzle-orm                 libs/context-distill/package.json:20:6      
pg                          libs/context-distill/package.json:21:6      
@types/pg                   libs/context-distill/package.json:22:6      
testcontainers              libs/diary-service/package.json:29:6        
@testing-library/react      libs/entry-explore-mcp-app/package.json:30:6
vitest                      libs/mcp-test-harness/package.json:22:6     
@nx/devkit                  package.json:83:6                           
@swc/helpers                package.json:95:6                           
husky                       package.json:104:6                          
lint-staged                 package.json:109:6                          
vite-plugin-dts             package.json:117:6                          
@types/figlet               tools/package.json:61:6                     
�[93m�[4mReferenced optional peerDependencies�[24m�[39m (1)
ink  libs/design-system/package.json
�[93m�[4mUnlisted dependencies�[24m�[39m (2)
@moltnet/database  evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/governance.e2e.test.ts:19:46
pg                 libs/diary-service/__tests__/diary-service.dbos.integration.test.ts:38:27                
�[93m�[4mUnlisted binaries�[24m�[39m (7)
openssl                                             .github/actions/legreffier-run-task/action.yml
python3                                             .github/workflows/ci.yml                      
clawhub                                             .github/workflows/release.yml                 
go                                                  package.json                                  
gofmt                                               package.json                                  
packages/openclaw-skill/scripts/publish-clawhub.sh  package.json                                  
packages/openclaw-skill/scripts/package.sh          package.json                                  
�[93m�[4mUnused exports�[24m�[39m (96)
COMMON_REQUIRED_FLAGS                       apps/agent-daemon/src/lib/help.ts:3:14                        
COMMON_OPTIONAL_FLAGS                       apps/agent-daemon/src/lib/help.ts:10:14                       
buildDaemonSlotId                 function  apps/agent-daemon/src/lib/task-execution-plan.ts:76:17        
ENTRY_TYPE_LABELS                           apps/console/src/diaries/utils.ts:14:3                        
ENTRY_TYPES                                 apps/console/src/diaries/utils.ts:15:3                        
estimateTokenCount                          apps/console/src/diaries/utils.ts:16:3                        
formatDateTime                              apps/console/src/diaries/utils.ts:17:3                        
ENTRY_TYPE_OPTIONS                          apps/console/src/diaries/utils.ts:21:14                       
getEntryTypeQuery                 function  apps/console/src/diaries/utils.ts:29:17                       
MOBILE_BREAKPOINT                           apps/console/src/hooks/useIsMobile.ts:3:14                    
TABLET_BREAKPOINT                           apps/console/src/hooks/useIsMobile.ts:4:14                    
groupTasksByLane                            apps/console/src/tasks/status.ts:25:3                         
statusToLane                                apps/console/src/tasks/status.ts:26:3                         
TASK_LANES                                  apps/console/src/tasks/status.ts:27:3                         
consoleCorrelationUrl             function  apps/issue-lifecycle/src/status-comment.ts:36:17              
consoleAttemptUrl                 function  apps/issue-lifecycle/src/status-comment.ts:48:17              
outputState                       function  apps/issue-lifecycle/src/test-fakes.ts:10:17                  
API_BASE_URL                                apps/landing/src/api.ts:16:14                                 
handleDiaryTags                   function  apps/mcp-server/src/diary-tools.ts:315:23                     
handleGrantCreate                 function  apps/mcp-server/src/grant-tools.ts:38:23                      
handleGrantRevoke                 function  apps/mcp-server/src/grant-tools.ts:70:23                      
handleGrantList                   function  apps/mcp-server/src/grant-tools.ts:102:23                     
handlePacksUpdate                 function  apps/mcp-server/src/pack-tools.ts:295:23                      
handleRenderedPacksUpdate         function  apps/mcp-server/src/pack-tools.ts:385:23                      
handlePacksDiff                   function  apps/mcp-server/src/pack-tools.ts:487:23                      
handleSignMessage                 function  apps/mcp-server/src/prompts.ts:212:23                         
EntryMapZoneSearchSchema                    apps/mcp-server/src/schemas/entry-explore-schemas.ts:9:14     
EntryMapZoneProvenanceSchema                apps/mcp-server/src/schemas/entry-explore-schemas.ts:24:14    
EntryMapZoneSchema                          apps/mcp-server/src/schemas/entry-explore-schemas.ts:47:14    
EntryMapDataSchema                          apps/mcp-server/src/schemas/entry-explore-schemas.ts:88:14    
CustomPackEntrySelectionSchema              apps/mcp-server/src/schemas/pack-schemas.ts:107:14            
handleTasksContinue               function  apps/mcp-server/src/task-tools.ts:163:23                      
handleTeamsList                   function  apps/mcp-server/src/team-tools.ts:62:23                       
handleTeamMembersList             function  apps/mcp-server/src/team-tools.ts:84:23                       
handleTeamsCreate                 function  apps/mcp-server/src/team-tools.ts:109:23                      
handleTeamsJoin                   function  apps/mcp-server/src/team-tools.ts:132:23                      
handleTeamsDelete                 function  apps/mcp-server/src/team-tools.ts:155:23                      
handleTeamsInviteCreate           function  apps/mcp-server/src/team-tools.ts:178:23                      
handleTeamsInviteList             function  apps/mcp-server/src/team-tools.ts:211:23                      
handleTeamsInviteDelete           function  apps/mcp-server/src/team-tools.ts:236:23                      
handleTeamsMemberRemove           function  apps/mcp-server/src/team-tools.ts:264:23                      
ServerConfigSchema                          apps/rest-api/src/config.ts:26:14                             
DatabaseConfigSchema                        apps/rest-api/src/config.ts:38:14                             
WebhookConfigSchema                         apps/rest-api/src/config.ts:43:14                             
RecoveryConfigSchema                        apps/rest-api/src/config.ts:47:14                             
OryConfigSchema                             apps/rest-api/src/config.ts:51:14                             
ObservabilityConfigSchema                   apps/rest-api/src/config.ts:62:14                             
EmbeddingConfigSchema                       apps/rest-api/src/config.ts:98:14                             
SecurityConfigSchema                        apps/rest-api/src/config.ts:105:14                            
loadEmbeddingConfig               function  apps/rest-api/src/config.ts:302:17                            
loadPackGcConfig                  function  apps/rest-api/src/config.ts:312:17                            
loadTaskOrphanSweeperConfig       function  apps/rest-api/src/config.ts:322:17                            
acceptsProblemJson                          apps/rest-api/src/problems/index.ts:2:3                       
findProblemTypeByCode                       apps/rest-api/src/problems/index.ts:8:3                       
findProblemTypeByStatus                     apps/rest-api/src/problems/index.ts:9:3                       
getTypeUri                                  apps/rest-api/src/problems/index.ts:10:3                      
problemTypes                                apps/rest-api/src/problems/index.ts:12:3                      
DiaryTagCountSchema                         apps/rest-api/src/schemas/diary.ts:58:14                      
PublicAuthorSchema                          apps/rest-api/src/schemas/diary.ts:104:14                     
ContextPackEntrySchema                      apps/rest-api/src/schemas/packs.ts:9:14                       
TaskTypeDescriptorSchema                    apps/rest-api/src/schemas/tasks.ts:263:14                     
inflateRowCreator                 function  apps/rest-api/src/utils/auth-principal.ts:142:23              
resolvePrincipal                            apps/rest-api/src/utils/auth-principal.ts:191:10              
HumanOnboardingError              class     apps/rest-api/src/workflows/human-onboarding-workflow.ts:36:14
diaryTransferWorkflow                       apps/rest-api/src/workflows/index.ts:4:3                      
TRANSFER_DECISION_EVENT                     apps/rest-api/src/workflows/index.ts:7:3                      
HumanOnboardingError                        apps/rest-api/src/workflows/index.ts:12:3                     
DEFAULT_WORKFLOW_TIMEOUT_MS                 apps/rest-api/src/workflows/index.ts:46:3                     
runWorkflow                                 apps/rest-api/src/workflows/index.ts:47:3                     
FOUNDING_ACCEPT_EVENT                       apps/rest-api/src/workflows/index.ts:51:3                     
TeamFoundingTimeoutError                    apps/rest-api/src/workflows/index.ts:57:3                     
teamFoundingWorkflow                        apps/rest-api/src/workflows/index.ts:58:3                     
DEFAULT_WORKFLOW_TIMEOUT_MS                 apps/rest-api/src/workflows/run-workflow.ts:14:14             
runWorkflow                       function  apps/rest-api/src/workflows/run-workflow.ts:33:23             
TeamFoundingTimeoutError          class     apps/rest-api/src/workflows/team-founding-workflow.ts:32:14   
DEFAULT_E2E_REST_API_URL                    libs/bootstrap/src/e2e-harness.ts:26:14                       
DEFAULT_E2E_DATABASE_URL                    libs/bootstrap/src/e2e-harness.ts:27:14                       
DEFAULT_E2E_HYDRA_PUBLIC_URL                libs/bootstrap/src/e2e-harness.ts:29:14                       
DEFAULT_E2E_HYDRA_ADMIN_URL                 libs/bootstrap/src/e2e-harness.ts:30:14                       
DEFAULT_E2E_KETO_READ_URL                   libs/bootstrap/src/e2e-harness.ts:31:14                       
DEFAULT_E2E_KETO_WRITE_URL                  libs/bootstrap/src/e2e-harness.ts:32:14                       
DEFAULT_E2E_KRATOS_ADMIN_URL                libs/bootstrap/src/e2e-harness.ts:33:14                       
DEFAULT_E2E_AGENT_SCOPES                    libs/bootstrap/src/e2e-harness.ts:34:14                       
DBOSWorkflowConflictError                   libs/database/src/dbos.ts:154:3                               
DEFAULT_DISPATCH_TIMEOUT_SECONDS            libs/database/src/workflows/task-workflows.ts:134:14          
DEFAULT_RUNNING_TIMEOUT_SECONDS             libs/database/src/workflows/task-workflows.ts:138:14          
MAX_PUBLIC_CONTENT_LENGTH                   libs/diary-service/src/diary-service.ts:51:14                 
nextStepId                        function  libs/entry-explore-mcp-app/src/state/map.ts:117:17            
resolveTaskScratchPath            function  libs/pi-extension/src/runtime/task-workspace.ts:130:17        
makeClient                        function  packages/legreffier-cli/src/api.ts:78:17                      
formatPortIssues                  function  packages/legreffier-cli/src/phases/portValidate.ts:213:17     
gitMergeBase                      function  tools/src/tasksmith/gh-client.ts:151:23                       
gitShowFileAtRef                  function  tools/src/tasksmith/gh-client.ts:206:23                       
SEED_INSTRUCTION                            tools/src/tasksmith/task-extractor.ts:538:10                  
verifyTask                        function  tools/src/tasksmith/verify.ts:356:23                          
cleanupPrArtifacts                function  tools/src/tasksmith/verify.ts:480:23                          
�[93m�[4mUnused exported types�[24m�[39m (58)
MailRecord                      interface  apps/console/e2e/helpers/mailslurper.ts:3:18                      
GroupedTasks                    type       apps/console/src/tasks/status.ts:24:8                             
TaskLane                        type       apps/console/src/tasks/status.ts:28:8                             
TaskLaneId                      type       apps/console/src/tasks/status.ts:29:8                             
UiResourceData                  interface  apps/mcp-host/src/implementation.ts:25:18                         
EntryMapZoneSearch              type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:22:13        
EntryMapZone                    type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:86:13        
CorsPluginOptions               interface  apps/rest-api/src/plugins/cors.ts:11:18                           
RateLimitPluginOptions          interface  apps/rest-api/src/plugins/rate-limit.ts:19:18                     
ProblemType                     type       apps/rest-api/src/problems/index.ts:11:8                          
AgentPrincipal                  type       apps/rest-api/src/schemas/principal.ts:37:8                       
HumanPrincipal                  type       apps/rest-api/src/schemas/principal.ts:39:8                       
PrincipalIdentity               type       apps/rest-api/src/schemas/principal.ts:41:8                       
CreateTaskInput                 type       apps/rest-api/src/services/task.service.ts:2:8                    
AuthContext                     type       apps/rest-api/src/types.ts:14:3                                   
PermissionChecker               type       apps/rest-api/src/types.ts:15:3                                   
RelationshipReader              type       apps/rest-api/src/types.ts:16:3                                   
RelationshipWriter              type       apps/rest-api/src/types.ts:17:3                                   
DiaryTransferDeps               type       apps/rest-api/src/workflows/index.ts:2:8                          
DiaryTransferResult             type       apps/rest-api/src/workflows/index.ts:3:8                          
TransferDecision                type       apps/rest-api/src/workflows/index.ts:8:8                          
HumanOnboardingDeps             type       apps/rest-api/src/workflows/index.ts:11:8                         
HumanOnboardingResult           type       apps/rest-api/src/workflows/index.ts:13:8                         
LegreffierOnboardingDeps        type       apps/rest-api/src/workflows/index.ts:24:8                         
MaintenanceDeps                 type       apps/rest-api/src/workflows/index.ts:33:8                         
RegistrationDeps                type       apps/rest-api/src/workflows/index.ts:38:8                         
RegistrationResult              type       apps/rest-api/src/workflows/index.ts:39:8                         
RunWorkflowOptions              type       apps/rest-api/src/workflows/index.ts:48:8                         
FoundingMember                  type       apps/rest-api/src/workflows/index.ts:52:8                         
TeamFoundingDeps                type       apps/rest-api/src/workflows/index.ts:55:8                         
TeamFoundingResult              type       apps/rest-api/src/workflows/index.ts:56:8                         
RunWorkflowOptions              interface  apps/rest-api/src/workflows/run-workflow.ts:21:18                 
AdoptionState                   interface  docs/.vitepress/theme/auth/useAdoption.ts:38:18                   
AdoptionStageKey                type       docs/.vitepress/theme/auth/useAdoption.ts:284:13                  
AdoptionStage                   interface  docs/.vitepress/theme/auth/useAdoption.ts:292:18                  
DocsTeam                        interface  docs/.vitepress/theme/auth/useTeamSelection.ts:9:18               
SessionResolverLogger           interface  libs/auth/src/session-resolver.ts:24:18                           
GroupCreator                    interface  libs/database/src/repositories/group.repository.ts:15:18          
EntriesListArgs                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:28:18        
EntriesSearchArgs               interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:38:18        
DiaryTagsArgs                   interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:50:18        
EntriesGetArgs                  interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:57:18        
PacksCreateArgs                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:63:18        
PacksUpdateArgs                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:71:18        
PacksProvenanceArgs             interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:77:18        
CommandRegistrar                type       libs/pi-extension/src/commands/index.ts:5:3                       
SessionMeta                     type       libs/pi-extension/src/commands/index.ts:7:3                       
RateLimitRetryOptions           type       libs/sdk/src/retry.ts:5:15                                        
SuccessCriteriaRubricCriterion  interface  libs/task-ui/src/success-criteria.ts:80:18                        
RubricTemplate                  interface  libs/task-ui/src/success-criteria.ts:123:18                       
AgentAdapter                    type       packages/legreffier-cli/src/adapters/index.ts:11:15               
AgentAdapterOptions             type       packages/legreffier-cli/src/adapters/index.ts:11:29               
ResolveInstallationStatus       type       packages/legreffier-cli/src/phases/portResolveInstallation.ts:6:13
VerifyInstallationStatus        type       packages/legreffier-cli/src/phases/portVerifyInstallation.ts:4:13 
InitPhase                       type       packages/legreffier-cli/src/state.ts:4:13                         
EvalMode                        type       tools/src/tasks/scenario.ts:31:13                                 
EvalWorkspace                   type       tools/src/tasks/scenario.ts:32:13                                 
ScenarioCriterion               interface  tools/src/tasks/scenario.ts:34:18                                 
�[93m�[4mUnused catalog entries�[24m�[39m (4)
@anthropic-ai/claude-agent-sdk  default  pnpm-workspace.yaml:25:4 
@fastify/static                 default  pnpm-workspace.yaml:36:4 
@openai/codex-sdk               default  pnpm-workspace.yaml:61:4 
zod                             default  pnpm-workspace.yaml:150:3
�[33m�[4mConfiguration hints�[24m (4)�[39m
. �[90m(root)�[39m         knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["."]�[90m (16 unused files)�[39m           
tools            knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["tools"]�[90m (10 unused files)�[39m       
apps/rest-api    knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/rest-api"]�[90m (3 unused files)�[39m
apps/mcp-host    knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/mcp-host"]�[90m (2 unused files)�[39m
 ELIFECYCLE  Command failed with exit code 1.

@getlarge getlarge marked this pull request as ready for review June 6, 2026 16:38
@legreffier
Copy link
Copy Markdown
Contributor Author

legreffier Bot commented Jun 6, 2026

Complexity Review — PR #1334: feat: add GitHub issue lifecycle runner

Composite Score: 1.0 / 1.0

Verdict: Low-complexity, high-reviewability change. Well-isolated, single-purpose addition with proportional test coverage and excellent documentation.

Criterion Scores

Criterion Weight Pass/Fail Rationale
cognitive_load 0.25 ✅ Pass Single-purpose addition (one new app). Code is well-organized with clear separation of concerns. No unrelated refactors or dependency churn mixed in.
blast_radius 0.25 ✅ Pass New app is isolated in its own workspace. No changes to existing business logic, schema, migrations, auth paths, or shared utilities. Config changes are mechanical.
test_coverage_delta 0.20 ✅ Pass Tests added proportionally to risk: artifact parsing, happy-path continuation chain, plan review findings loop, approval polling, PR failure retry, review budget exhaustion.
security_surface 0.20 ✅ Pass Uses existing MoltNet CLI token minting. No new auth paths, cryptography, or secrets handling. GitHub token resolved from standard env vars or CLI.
reviewer_orientation 0.10 ✅ Pass Clear PR title/description. Comprehensive README with flow diagram, responsibilities, task contract, CLI usage, and test coverage summary.

Main Complexity Drivers

  • Lifecycle state machine: 9 phases (triaging → classified → plan_generated → approved → implementing → pr_open → pr_failed → releasing → notify → done) with review loops and retry logic
  • Continuation pattern: All agent tasks use freeform taskType with continueFrom chaining and claimCondition gating
  • Artifact contract: Each task must emit issue_lifecycle_state artifact with phase/decision/summary/findings shape

All complexity is appropriately contained within the new app boundary. No hidden complexity in existing code.

@legreffier legreffier Bot marked this pull request as draft June 6, 2026 20:29
@legreffier
Copy link
Copy Markdown
Contributor Author

legreffier Bot commented Jun 7, 2026

Follow-up for the lifecycle review and final reflection requirement:

  • Triage artifacts with decision: needs_triage now stop the workflow before planning instead of continuing.
  • The final task now always runs after release, even when the skip-notify label is present. In that case it skips participant notification only.
  • The final task success criteria now require a reflection diary entry, linked lifecycle-created entries, and a PR body/comment URL carrying the reflection link: reflectionEntryId, linkedEntryIds, prReflectionUrl.
  • README documents the reflection requirement and local smoke-test expectation.

Validation run:

  • pnpm nx sync
  • pnpm exec nx run @themoltnet/issue-lifecycle:test
  • pnpm exec nx run @themoltnet/issue-lifecycle:typecheck
  • pnpm exec nx run @themoltnet/issue-lifecycle:lint
  • pnpm exec nx run @themoltnet/issue-lifecycle:build

MoltNet diary: 8c30fb21-6a9f-4175-84d8-9b3b80c86c12

Per Edouard's request, legacy GitHub status check handling was intentionally left unchanged.

@legreffier
Copy link
Copy Markdown
Contributor Author

legreffier Bot commented Jun 7, 2026

Final reflection entry for this session:

  • reflectionEntryId: d41b1673-6bb4-44bb-8736-809cc0b1b14d
  • linkedEntryIds: [8c30fb21-6a9f-4175-84d8-9b3b80c86c12]
  • prReflectionUrl: this PR comment

This is the same publication shape now required from the issue-lifecycle final task.

@legreffier
Copy link
Copy Markdown
Contributor Author

legreffier Bot commented Jun 7, 2026

Follow-up: strengthened issue-lifecycle success criteria.

The lifecycle tasks now require structured evidence per phase without changing transition parsing:

  • triage: classification, labels, planningReady, actionability, missingInformation
  • plan: risks, testStrategy, acceptanceCriteria, touchedAreas, estimatedDiffRisk, noImplementationPerformed
  • review/revision: finding review and resolution evidence
  • implementation: changedFiles, testsRun, diaryEntryIds, planDeviations, remainingRisks, diffStats
  • release: releaseRequired, releaseActions, evidence
  • notify/reflection: followUps in addition to reflectionEntryId, linkedEntryIds, prReflectionUrl

Validation run:

  • pnpm exec nx run @themoltnet/issue-lifecycle:test
  • pnpm exec nx run @themoltnet/issue-lifecycle:typecheck
  • pnpm exec nx run @themoltnet/issue-lifecycle:lint
  • pnpm exec nx run @themoltnet/issue-lifecycle:build

MoltNet diary: 14e8ae97-cb93-46cf-afb4-f3df5b9d5367

@legreffier
Copy link
Copy Markdown
Contributor Author

legreffier Bot commented Jun 7, 2026

Manual local e2e smoke found and fixed a daemon continuation bug.

Observed chain on local e2e:

  • triage task completed: f90c2ba8-537b-44f2-98d9-08cfdf1372ae
  • plan continuation failed before model execution: e307af5a-3f96-444a-ab1b-8079b24a8784
  • correlation: 917d5ebb-b9e9-48cf-9e08-97a53cfbd6f0

Root cause: freeform continuation planning carried the producer worktree branch but not the producer workspaceId. The workspace materializer then fell back to a new task-scoped worktree path and tried to check out a branch already attached to the parent warm-session worktree.

Fix: preserve the producer workspaceId when attaching warm-slot context for freeform continuations, plus a regression assertion.

Validation run:

  • pnpm exec nx run @themoltnet/agent-daemon:test -- --run src/lib/execution-plan-cache.test.ts src/lib/task-execution-plan.test.ts
  • pnpm exec nx run @themoltnet/agent-daemon:typecheck
  • pnpm exec nx run @themoltnet/agent-daemon:lint
  • pnpm exec nx run @themoltnet/agent-daemon:build

Diary:

  • incident: 0a174251-0fbc-4eed-9d2b-879b065f38b5
  • commit: 961a0b11-7c82-407f-893c-042288cbdd91

@legreffier
Copy link
Copy Markdown
Contributor Author

legreffier Bot commented Jun 7, 2026

Manual smoke follow-up: the second local lifecycle run failed after plan review because the review artifact returned structured finding objects, but the lifecycle parser kept only string findings and treated the review as empty.

Fixed in 2a139434: structured findings are normalized into revision text, and a negative review with no explicit findings now creates a defensive plan-revision task instead of failing the Absurd workflow immediately.

Validation:

  • pnpm nx sync
  • pnpm exec nx run @themoltnet/issue-lifecycle:test
  • pnpm exec nx run @themoltnet/issue-lifecycle:typecheck
  • pnpm exec nx run @themoltnet/issue-lifecycle:lint
  • pnpm exec nx run @themoltnet/issue-lifecycle:build

MoltNet-Diary: 4b57412d-b84b-4a11-a4f6-2ca2dc071f36

Copy link
Copy Markdown
Owner

@getlarge getlarge left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we start implementation, we should create a fresh task (not continue from) workspace to clear the context.
Just pass the plan one way or the other, via an artifact to pick from the previous work tree, an issue comment, an entry.

@getlarge getlarge force-pushed the issue-1327-build-github-issue-lifecycle-app branch from 56e6d0b to e10f6eb Compare June 8, 2026 04:18
Comment thread apps/issue-lifecycle/src/workflow.ts Fixed
legreffier Bot added 13 commits June 8, 2026 06:35
MoltNet-Diary: e0d861ac-514f-43a8-9164-a83c3ee7e84e
MoltNet-Diary: 0abaef16-674e-4f71-8185-52be9669e178
MoltNet-Diary: 72278ccd-672b-4076-ae6e-14efe1c5a3ae
MoltNet-Diary: a9e6bb63-b0fd-4291-ad85-2955c82272aa
MoltNet-Diary: e79044f7-a688-47a4-a932-15c7ac5fa7a9
MoltNet-Diary: db74e69c-1042-4678-b688-983ca8b3c8a1
MoltNet-Diary: 8c30fb21-6a9f-4175-84d8-9b3b80c86c12
MoltNet-Diary: 14e8ae97-cb93-46cf-afb4-f3df5b9d5367
MoltNet-Diary: 961a0b11-7c82-407f-893c-042288cbdd91
MoltNet-Diary: 4b57412d-b84b-4a11-a4f6-2ca2dc071f36
MoltNet-Diary: d3b16ee3-7633-4ff1-b859-c6f392735174
MoltNet-Diary: 48eca512-32da-416a-a7fc-3ec5d9705d13
@getlarge getlarge force-pushed the issue-1327-build-github-issue-lifecycle-app branch from a048944 to 4943864 Compare June 8, 2026 04:36
Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is huge. Time to split, create separate step functions. I'm pretty sure steps are not safely implemented, some steps included several mutation function calls. 1 mutation = 1 step.
Check the docs https://earendil-works.github.io/absurd/

Also we should make use of events https://earendil-works.github.io/absurd/concepts/ instead of waiting/polling

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

consider installing the absurd skill instead of our docs -> https://earendil-works.github.io/absurd/agents/

legreffier Bot added 2 commits June 8, 2026 19:54
Split issue lifecycle status/comment rendering and durable workflow step helpers out of the main orchestration file. Expose Absurd events through the workflow context, use event-aware waits with sleep fallback, and keep GitHub comment/label writes in dedicated step calls.

MoltNet-Diary: 16cbad53-f124-44ea-860e-9feae875b1b2
Install Absurd's bundled agent skill into the repository so agents can load the local absurdctl debugging playbook when working on issue-lifecycle durable workflows.

MoltNet-Diary: 1c347b2c-07c1-46c1-922e-0179f9e3c47e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Build GitHub issue lifecycle app using freeform continuations

2 participants