feat: harden async tools, streaming, auth, and v0.0.10 release - #24
Conversation
|
Warning Review limit reached
Next review available in: 45 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe release updates version metadata to 0.0.10, adds release and artifact verification, converts REST tools to asynchronous handlers, and hardens authentication, installation, SSE/Deep Research processing, private artifacts, CI, documentation, and regression coverage. ChangesRelease 0.0.10 and validation
Runtime hardening
Sequence Diagram(s)sequenceDiagram
participant MCPTool
participant AsyncBackend
participant BackendClient
participant ChatGPTAPI
MCPTool->>AsyncBackend: await REST tool request
AsyncBackend->>BackendClient: execute synchronous request in thread
BackendClient->>ChatGPTAPI: HTTP request
ChatGPTAPI-->>BackendClient: response
BackendClient-->>AsyncBackend: response payload
AsyncBackend-->>MCPTool: tool result
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Review failedAn error occurred during the review process. Please try again later. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
gpt2agent/sentinel.py (1)
75-86: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPOW failure path never trips here
_pow.solve_pow()returns a non-empty stub token even when it doesn’t solve the challenge, soif not proofcan never fire. A required POW miss still gets an invalid token instead of failing closed. Make the solver returnNone/raise on failure, or surface the solved flag so this branch can reject it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gpt2agent/sentinel.py` around lines 75 - 86, Ensure required POW failures are rejected in the POW handling branch of the sentinel request flow: update _pow.solve_pow to return None or raise when it cannot solve the challenge, or expose a solved-status result and check it alongside proof before assigning out["proof"]. Remove reliance on a non-empty stub token so unsolved challenges raise the existing failure error.
🧹 Nitpick comments (1)
gpt2agent/sse.py (1)
85-101: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider
O_NOFOLLOWfor the raw-dump file, for consistency with other output-hardening in this PR.
_raw_dumpnow tightens permissions to0o600(good), but theos.opencall doesn't passos.O_NOFOLLOW. The bundled deep-research runner hardens its own output files against symlink attacks (seetest_bundled_runner_refuses_symlinked_output_artifact), so this debug dump path (which can contain full conversation content) is inconsistent with that pattern. Risk is low sinceGPT2AGENT_RAW_DUMPis a developer-set debug env var, but worth aligning for defense-in-depth.🔒 Suggested hardening
- fd = os.open(out, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600) + flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND + if hasattr(os, "O_NOFOLLOW"): + flags |= os.O_NOFOLLOW + fd = os.open(out, flags, 0o600)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gpt2agent/sse.py` around lines 85 - 101, Harden _raw_dump’s file creation against symlink traversal by adding os.O_NOFOLLOW to the flags passed to os.open, matching the output-file security pattern used elsewhere; preserve compatibility by conditionally including the flag when available and continue handling resulting OS errors through the existing exception path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 21: Set persist-credentials: false on every actions/checkout step in the
workflow, including the four checkout entries identified in the diff. Preserve
the existing pinned action revisions and add the option under each checkout
configuration.
---
Outside diff comments:
In `@gpt2agent/sentinel.py`:
- Around line 75-86: Ensure required POW failures are rejected in the POW
handling branch of the sentinel request flow: update _pow.solve_pow to return
None or raise when it cannot solve the challenge, or expose a solved-status
result and check it alongside proof before assigning out["proof"]. Remove
reliance on a non-empty stub token so unsolved challenges raise the existing
failure error.
---
Nitpick comments:
In `@gpt2agent/sse.py`:
- Around line 85-101: Harden _raw_dump’s file creation against symlink traversal
by adding os.O_NOFOLLOW to the flags passed to os.open, matching the output-file
security pattern used elsewhere; preserve compatibility by conditionally
including the flag when available and continue handling resulting OS errors
through the existing exception path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b88d1565-9053-48f8-94e1-6fa7fc59e16d
📒 Files selected for processing (64)
.claude-plugin/plugin.json.github/dependabot.yml.github/pull_request_template.md.github/workflows/ci.yml.github/workflows/release.yml.gitignoreCHANGELOG.mdCONTRIBUTING.mdMANIFEST.inQA_REPORT.htmlREADME.mdartifacts/verify/heavy-dr-citations-20260603.mddocs/clients.mddocs/configuration.mddocs/faq.mddocs/how-it-works.mddocs/quickstart.mddocs/troubleshooting.mdgpt2agent/__init__.pygpt2agent/__main__.pygpt2agent/_vendored/turnstile.pygpt2agent/auth.pygpt2agent/backend.pygpt2agent/install.pygpt2agent/sentinel.pygpt2agent/setup.pygpt2agent/skills/deep-research/SKILL.mdgpt2agent/skills/deep-research/bin/deep_research.pygpt2agent/skills/deep-research/bin/quota.shgpt2agent/skills/deep-research/bin/run.shgpt2agent/skills/gpt2agent/SKILL.mdgpt2agent/skills/gpt2agent/tools-reference.mdgpt2agent/sse.pygpt2agent/tools/_backend.pygpt2agent/tools/_ids.pygpt2agent/tools/_redact.pygpt2agent/tools/account.pygpt2agent/tools/apps.pygpt2agent/tools/codex.pygpt2agent/tools/conversations.pygpt2agent/tools/gpts.pygpt2agent/tools/images.pygpt2agent/tools/instructions.pygpt2agent/tools/memory.pygpt2agent/tools/writes.pyinstall.shpyproject.tomlscripts/verify_pypi_artifacts.pyscripts/verify_release.pyserver.jsontests/fixtures/heavy_dr_widget_state.jsontests/test_audit_2026_06_26.pytests/test_audit_2026_07_02.pytests/test_audit_2026_07_09_auth.pytests/test_audit_2026_07_09_package.pytests/test_audit_2026_07_09_streaming.pytests/test_audit_2026_07_09_tools.pytests/test_dr_clarification.pytests/test_heavy_dr_parser.pytests/test_install.pytests/test_none_guards.pytests/test_release_metadata.pytests/test_security_hardening.pytests/test_tools.py
| name: Python quality + release metadata | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on all actions/checkout steps.
By default, actions/checkout persists the GitHub token in .git/config, making it accessible to any subsequent step. While the current workflow steps are trusted, adding persist-credentials: false is a trivial hardening measure that prevents credential leakage if a future step is added or a dependency is compromised.
🔒️ Proposed fix (apply to all four checkout steps)
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ with:
+ persist-credentials: falseAlso applies to: 49-49, 79-79, 100-100
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 21, Set persist-credentials: false on every
actions/checkout step in the workflow, including the four checkout entries
identified in the diff. Preserve the existing pinned action revisions and add
the option under each checkout configuration.
Source: Linters/SAST tools
1 participant
Summary
CODEX_HOME, pipx interpreter migration, and Windows package smoke coverage0.0.10Verification
SKIP_LIVE=1 python -m pytest -q— 318 passed, 9 skippedpython -m ruff check gpt2agent tests scriptspython scripts/verify_release.pypython -m compileall -q gpt2agent tests scriptspip-audit --strict .— no known vulnerabilitiesgit archive HEADbuild and Twine checkpip check, CLI/module/resource/skill smoke0.0.10d019af67cc267210865d86b2fd73789b764f5e28a8e4d899039364390d3798a58e2622ec1a3addddef4b0ff8409649e693e3eed2a8a95705bf237c5662551dfbCloses #22