Conversation
… groups
- Add slash_commands to all 10 frameworks that were missing them
(generic, agent_zero, ironclaw, microclaw, moltics, nanoclaw,
nullclaw, picoclaw, shibaclaw, zeroclaw) — every framework
now exposes at least /help.
- New endpoint GET /api/agents/{slug}/slash-commands returns
a single agent's command list, keyed by slug.
- SlashMenu: accept optional scopedAgent prop; when set, only
show commands for that agent with the header visible.
- MessagesApp: in group channels (3+ members), slash menu only
opens for @agentname / pattern — bare / no longer shows all
agents' commands. In DMs, leading / still opens the single
agent's menu as before.
- Add SlashMenu scopedAgent test + 3 backend agent-specific
slash-command endpoint tests.
Fixes #840
… endpoint docstring - MessagesApp.tsx: move slash block (isDm/showSlash/slashAgent/slashQuery) below currentChannel declaration to fix TDZ; anchor @token/ regex with ^; guard isDm against 0/1-member degenerate channels (=== 2 instead of <= 2) - test_routes_framework.py: update test_framework_without_slash_commands assertion — generic now includes /help as a built-in slash command - framework.py: fix agent_slash_commands docstring — unknown agent returns 404, not empty command list (matching actual behavior)
First self-contained slice of the taOSnet Phase-2 client work. Decides whether a model's weights may be redistributed over the swarm, so the catalog-publish CLI can set each variant's license_allows_redistribution flag (which the download client already requires before touching the swarm). Conservative by default: restrictive markers (non-commercial, research, gated, S-Lab) force False; an explicit allow-list covers permissive + RAIL + Gemma + Llama-community licences; everything else defaults False for human review. Covers every licence string currently in app-catalog/models.
…not env vars SearXNG only reads SEARXNG_SETTINGS_PATH and SEARXNG_DISABLE_ETC_SETTINGS — there is no generic SEARXNG_* nested override (the __ pattern is Home Assistant, not SearXNG). The previous env-var approach did nothing. Instead, seed a real settings.yml with use_default_settings:true, search.formats:[html,json], and a per-install generated server.secret_key via a new config_files mechanism in the Docker installer. The file is bind-mounted as ./settings.yml:/etc/searxng/settings.yml:ro so it overrides the default settings.yml inside the named config volume. Fixes #969
fix(chat): TS2448 TDZ + generic /help test + endpoint docstring
feat(taosnet): license-eligibility classifier
Closed-swarm client plumbing in torrent_downloader.py: inject the node's account-bound passkey into the private tracker announce, add BEP-19 web seeds, implement torrent_url metadata fetch, and disable DHT session-wide (taOSnet is a private authenticated mesh). New pure helpers in taosnet/torrent_client.py (announce/scrape/metadata URLs). Passkey acquisition + 401 re-announce stay with the caller (DownloadManager, has account context) and land next.
…losed swarm The doc still described the original open-swarm design (opentracker on tinyagentos.com, a home seedbox, DHT bootstrap). taOSnet shipped closed and account-authenticated. Add a Current state section (passkey, private tracker on taos.my, VPS+GDrive seedbox, HF web-seed fallback, DHT off, license-eligibility gate) and point at the authoritative live contract in docs/taosnet.md. The original design is kept below for history.
feat(taosnet): client passkey + web-seed + torrent_url wiring, DHT off
docs(taosnet): reconcile design doc with the shipped closed swarm
…, and clean up manifest CRITICAL: Validate config_files[*].path against traversal — reject absolute paths, '..' components, and symlink escapes outside app_dir. Validate entry shape (dict with path+content) with clear ValueError messages instead of bare KeyError/TypeError. Persist secret_key in .secret_key file so re-installs don't silently rotate SearXNG's secret. SUGGESTION: Remove redundant named volume config:/etc/searxng from manifest since settings.yml is bind-mounted. Fix brittle key_val prefix-slice parse in tests — use split() instead. 6 new tests: missing-path, missing-content, absolute-path, dotdot-path, symlink-escape, secret-key-persistence. All 29 installer+catalog tests pass.
fix(searxng): enable JSON output format via settings.yml bind mount, not env vars
…fix (#1730, #1732) (#1733) * fix(install-rknpu): bump rkllama pin to restore --preload (#1730) The beta.35 rkllama pin (d92668e) had dropped --preload upstream, but the generated rkllama.service still passes --preload, so rkllama failed to start with 'unrecognized arguments: --preload' on a fresh install, blocking RKLLM entirely. Bump the pin to 02ef2a6, which restores the --preload startup flag (jaylfc/rkllama#1, validated on RK3588 by @mandresve), so the systemd unit's preload of the embedding/reranker/query-expansion models works again. Reported by @mandresve (#1730). * fix(install-rknpu): pin rkllama with --preload restore + context-overflow fix (#1730, #1732) Bump to 5e38bd2, which bundles two rkllama fixes: restore the --preload startup flag (jaylfc/rkllama#1) so the generated service starts (#1730), and a pre-flight context-length guard + fail-safe worker-EOF handling so an over-long prompt returns a clean HTTP 400 instead of crashing the worker with an EOFError (jaylfc/rkllama#3, #1732). Both reported by @mandresve.
…pp secret (#1734) Fold on #1724 (searxng config_files). The per-app .secret_key signs sessions, so write it owner-only (0600) instead of the default 0644, and regenerate it if a prior write left it empty or not 64 hex chars, so an install never substitutes a blank secret_key into the mounted config.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
|
👋 Thanks for the PR! This one targets See CONTRIBUTING.md for the branch model. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (23)
📝 WalkthroughWalkthroughThis PR bundles a per-agent slash-command feature (backend endpoint, framework registry, MessagesApp/SlashMenu scoping), DockerInstaller support for declarative config files with secret-key templating and path validation, new taOSnet modules (license eligibility, torrent client URL builders), torrent downloader passkey/web-seed wiring, a design doc update, and release version/changelog bumps plus an rkllama installer ref pin. ChangesPer-agent slash command scoping
Secure per-app config file generation
taOSnet torrent client and license eligibility
Release housekeeping
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant MessagesApp
participant SlashMenu
participant FrameworkAPI
User->>MessagesApp: type "`@tom` /help"
MessagesApp->>MessagesApp: parse slashAgent, slashQuery, showSlash
MessagesApp->>SlashMenu: render(scopedAgent=slashAgent)
SlashMenu->>SlashMenu: buildRows(scopedAgent) filters to single agent
MessagesApp->>FrameworkAPI: GET /api/agents/tom/slash-commands
FrameworkAPI-->>MessagesApp: {tom: [{name, description}, ...]}
sequenceDiagram
participant TorrentDownloader
participant Tracker
participant HTTPClient
TorrentDownloader->>TorrentDownloader: _build_params(source, passkey, web_seeds)
alt source is torrent URL
TorrentDownloader->>HTTPClient: GET .torrent metadata
HTTPClient-->>TorrentDownloader: torrent bytes
end
TorrentDownloader->>Tracker: announce with passkey tracker URL
TorrentDownloader->>TorrentDownloader: add web_seeds to url_seeds
TorrentDownloader-->>TorrentDownloader: download(...) returns TorrentTask
Possibly related issues
Possibly related PRs
Suggested reviewers: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| 404, unknown framework → empty command list. | ||
| """ | ||
| config = getattr(request.app.state, "config", None) | ||
| agents = getattr(config, "agents", []) if config else [] |
There was a problem hiding this comment.
SUGGESTION: config.agents may be None, raising TypeError
agents = getattr(config, "agents", []) if config else [] only substitutes [] when config itself is falsy. If request.app.state.config is set but its agents attribute is None, next((...) for a in None) raises TypeError and the endpoint 500s. Use getattr(config, "agents", []) or [], and consider guarding a.get("name") for non-dict entries.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| ``torrent_url`` instead of a magnet.""" | ||
| import httpx | ||
|
|
||
| resp = httpx.get(url, timeout=30.0, follow_redirects=True) |
There was a problem hiding this comment.
WARNING: Untrusted torrent_url fetched with redirects and no size/validity guard
This fetches a manifest-supplied URL with follow_redirects=True, no max response size, and feeds resp.content straight into lt.bdecode/lt.torrent_info on line 195. A corrupt, non-torrent, oversized, or redirect-to-internal response raises an uncaught exception or can exhaust memory instead of failing cleanly. Validate the content type, cap resp.content size, and wrap the decode in try/except that raises TorrentError.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| const isDm = agentMembers.length === 1; | ||
| let agentMembers = members.filter((m) => m !== "user" && commands[m]); | ||
| // When scopedAgent is set, only show commands for that agent. | ||
| if (scopedAgent && agentMembers.includes(scopedAgent)) { |
There was a problem hiding this comment.
SUGGESTION: Unknown scopedAgent silently falls back to all agents' commands
When scopedAgent is set but is not present in agentMembers (e.g. a typo'd @handle /), the guard is skipped and the menu shows every agent's commands instead of an empty set. Consider treating an unrecognised scoped agent as an empty result so the @agent / affordance stays predictable.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| // slash menu. In a group channel (3+ members), the user must prefix | ||
| // with "@agentname /" so we know which agent's commands to show. | ||
| const isDm = (currentChannel?.members?.length ?? 0) === 2; | ||
| const showSlash = isDm ? input.startsWith("/") : /^@\S+\s+\//.test(input); |
There was a problem hiding this comment.
SUGGESTION: Group slash trigger requires a space before / (@agent /); @agent/ won't open the menu
showSlash (and slashAgent on line 1432) anchor the regex on /^@\S+\s+\//, so @agent/help (no space between handle and slash) does not open the scoped menu. Allowing an optional space between the handle and / would be more forgiving for users.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 4 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (23 files)
Fix these issues in Kilo Cloud Reviewed by hy3-20260706:free · Input: 106.3K · Output: 26.1K · Cached: 1M |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes dev to master for the 1.0.0-beta.36 release.
Ships since beta.35:
Tag v1.0.0-beta.36 on the resulting master SHA after merge.
Summary by CodeRabbit
New Features
Bug Fixes
Changed