feat(sdk): make project context integrity explicit - #767
Conversation
Deliver a cohesive SDK and CLI context-management bundle across list corpus completeness, dependency provenance, extension command quarantine, structured recovery, and merge receipt safety.\n\nExpose strict fail-closed reads through CLI/SDK/tool contracts, preserve author and source provenance on dependency edges, retain healthy extension commands when siblings are malformed, constrain recovery inference to invoked-command contracts, normalize legacy merge receipt quoting, and refresh merge fences for every runtime item type.\n\nUpdate generated contracts, public surface, token budgets, package changelog, operator documentation, PM evidence, and regression coverage. Full release gates pass locally through 6452 tests at 100/100/100/100, packed npm smoke, and 88-command package-first dogfood; exact-SHA hosted analysis follows after push.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Warning Review limit reached
Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (53)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@greptileai please review the complete exact head 04ddbd7. Focus on SDK/CLI contract integrity, extension quarantine, recovery scope, merge safety, and agent-token efficiency. |
|
@coderabbitai full review |
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 59 minutes. |
Merging this PR will improve performance by 2.48%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ⚡ | createQueryFingerprint |
533.9 µs | 521 µs | +2.48% |
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing feat/sdk-context-integrity-contracts (943776b) with main (f4817e0)
|
Gemini Code Assist sunset notice acknowledged (comment 5089182623): this provided no code review or actionable finding, so no implementation response is required. Exact-head validation remains covered by the active hosted gates and available reviewers. |
|
CodeRabbit rate-limit notices acknowledged (comments 5089187281 and 5089189098): they selected the full 54-file exact-head range but returned no code findings because the included review quota is unavailable. This is reviewer infrastructure unavailability, not an approval; the PR remains open for Greptile and all required hosted checks. |
|
Sourcery review 4785185199 acknowledged: it returned only a weekly diff-character quota notice and no code finding. This is recorded as reviewer unavailability, while exact-head CI, security scanners, and the requested Greptile review continue independently. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Remove clone-local package item types written by an extension-enabled merge install. The committed fence must be reproducible under CI's --no-extensions contract while extension-owned runtime types remain clone-local.\n\nRecord the hosted failure diagnosis and exact passing merge-safety sequence in pm-9nfpwd.
|
Hosted static-gate correction pushed at exact head 943776b: the committed merge fence is now reproducible under --no-extensions, and the exact CI merge-install, strict storage/history validation, and representative history verification sequence passes locally. @greptileai please review this complete exact head. |
|
@coderabbitai full review exact head 943776b |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 53 minutes. |
|
CodSpeed report 5089210171 acknowledged and up-voted: exact head 943776b shows a measured 2.48% improvement in createQueryFingerprint with the other ten benchmarks unchanged. Because the report flags differing runtime environments, I am treating the magnitude as directional evidence only; the mandatory benchmark gate itself is green. |
|
Codecov report 5089221700 acknowledged and up-voted: all modified coverable lines are covered and all tests passed. This agrees with the four green hosted coverage shards and the local 44,548/31,650/9,116/43,281 100% coverage result. |
|
CodeRabbit exact-head response 5089237830 acknowledged and down-voted: it confirms receipt of head 943776b but again returns only fair-usage unavailability and no code finding. It is recorded as unavailable review infrastructure, not approval or evidence against the independently green gates. |
|
Final exact-head review inventory for 943776b: all required checks are green; all four coverage shards and the aggregate coverage gate pass; static, typecheck, compatibility, smokes, Windows/macOS/Linux runtime, docs, benchmarks, CodeQL, DeepScan, CodeFactor, Hound, Semgrep, Trivy, TruffleHog, ShellCheck, PSScriptAnalyzer, actionlint, Codecov, and CodSpeed are successful. There are zero inline review threads. Every surfaced bot comment/review has a usefulness reaction and explicit disposition. CodeRabbit and Sourcery returned quota unavailability without findings; Gemini is sunset. Greptile was explicitly requested twice, including after the final push, but exposed no check/comment/review, so it is recorded as unavailable rather than approval. |
1 participant
Outcome
This broad SDK/CLI bundle turns context integrity into explicit, machine-readable contracts across five related failure surfaces:
It also updates generated contracts, the public SDK surface, token budgets, documentation, the package-generated changelog, PM histories, and focused regressions.
PM lineage
Verification
Closes #752
Closes #755
Closes #757
Closes #763
Closes #764
Summary by cubic
Make context integrity explicit across the SDK and CLI. Adds truthful list completeness with strict reads, preserves dependency provenance, isolates bad extension commands, tightens recovery hints, fixes merge receipt quoting, and keeps committed merge fences extension‑independent.
New Features
completenesswith unreadable counts; add--strict-readto fail closed inpm list*and SDK/MCP tool contracts.author,author_source, andsource_kind(defaults to detected author and CLI source); persisted and rendered in items.close --validate-close strictemits a concrete retry when required fields are missing.Bug Fixes
%Pwithout extra quotes and receipts strip one legacy quote pair; committed fences are extension‑independent (extension-owned types stay clone‑local).Written for commit 943776b. Summary will update on new commits.