fix(cli): avoid false dirty warnings on onboarding resume by WcaleNieWolny · Pull Request #3003 · Cap-go/capgo.app

WcaleNieWolny · 2026-08-11T18:59:37Z

Summary

fingerprint successful automatic Capgo onboarding mutations with scoped Git status, SHA-256, and mode data
persist and validate fingerprints so exact Capgo-only changes skip the warning while mixed states show only unsafe files
fail closed on partial operations, malformed or racy state, persistence failures, and unsafe native reset paths

Test plan

bun run cli:check
git diff --check
independent spec, code-quality, and whole-feature reviews

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

New Features
- Improved onboarding recovery by tracking and safely resuming setup progress.
- Added clearer handling for recognized changes, unexpected edits, reset, decline, and discard actions.
- Added safer native platform setup and reset operations.
Bug Fixes
- Improved repository checks for staged, deleted, renamed, and path-specific changes.
- Prevented incomplete setup operations from being treated as successful.
- Added safeguards against unsafe files and directory locations.
Documentation
- Documented Git-based onboarding change tracking, recovery behavior, and failure handling.

coderabbitai · 2026-08-11T19:00:06Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 762a6f1d-2254-4086-a640-55163d15075f

📥 Commits

Reviewing files that changed from the base of the PR and between 0ad364c and 72917bc.

📒 Files selected for processing (2)

cli/src/init/command.ts
cli/test/test-init-guardrails.mjs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Cap-go/capacitor-updater (manual)

📝 Walkthrough

Walkthrough

The init command tracks automatic Git mutations with validated fingerprints, persists resumable progress, classifies repository changes, validates native-directory boundaries, and restores or clears tracked state across onboarding lifecycle transitions. Guardrail tests cover parsing, attribution, persistence, failure handling, and path safety.

Changes

Onboarding Git tracking

Layer / File(s)	Summary
Git snapshots and change classification `cli/src/init/command.ts`, `cli/test/test-init-guardrails.mjs`, `docs/superpowers/specs/...`	The init command parses porcelain v2 status output, validates paths and metadata, creates SHA-256 fingerprints, merges snapshots, and classifies saved versus unsafe changes. Tests and the design specification cover these contracts.
Progress persistence and resume handling `cli/src/init/command.ts`, `cli/test/test-init-guardrails.mjs`, `docs/superpowers/specs/...`	The cleanliness gate and resume flows persist recognized changes, restore validated state, and clear progress for rejection, decline, discard, and failure paths.
Tracked onboarding mutations `cli/src/init/command.ts`, `cli/test/test-init-guardrails.mjs`, `docs/superpowers/specs/...`	Package installation, configuration updates, file edits, encryption setup, updater installation, and cleanup operations use scoped before-and-after mutation tracking.
Safe native operations and build synchronization `cli/src/init/command.ts`, `cli/test/test-init-guardrails.mjs`	Native reset, platform creation, build, and sync flows validate directory boundaries and track changes within the selected native scope.

Estimated code review effort: 5 (Critical) | ~90 minutes

Possibly related PRs

Cap-go/capgo.app#2916: Both PRs modify onboarding package installation and updater operations in cli/src/init/command.ts.
Cap-go/capgo.app#2945: Both PRs modify onboarding resume flows in cli/src/init/command.ts.

Suggested labels: codex

Suggested reviewers: dalanir, riderx

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: preventing false dirty Git warnings during onboarding resume.
Description check	✅ Passed	The description includes a focused summary and test plan with relevant validation commands, although the checklist and screenshots sections are omitted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

cursor

Stale comment

Risk: medium. Left a non-blocking comment — this CLI onboarding git-fingerprint/resume change is above the low-risk auto-approval threshold, and Cursor Bugbot was not present to provide a clean automated-review signal. Human review is needed; assigning reviewers next.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

codspeed-hq · 2026-08-11T19:02:15Z

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

_{Comparing wolny/fix-onboarding-dirty-git-resume (72917bc) with main (ebb7cbc)}

2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

coderabbitai

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cli/src/init/command.ts`:
- Around line 941-980: Bound captureInitGitSnapshot before hashing files by
tracking the scoped entry count and total file size, and return undefined once
either configured threshold is exceeded. Apply this to directory-scoped
snapshots so oversized native trees are classified as unrecognized, while
preserving normal fingerprinting below the limits and the existing fail-closed
behavior in trackInitGitChanges.
- Around line 655-674: Canonicalize startDir in createInitGitChangeScope before
resolving targets, using the same realpath-based approach as getInitGitRepoRoot,
then resolve each target against that canonical directory before computing
repository-relative paths. Preserve the existing validation and empty-scope
behavior for invalid targets, while ensuring symlinked start directories produce
paths relative to repoRoot.

In `@cli/test/test-init-guardrails.mjs`:
- Around line 445-457: Replace the repeated git initialization, user
configuration, staging, and commit setup in the tests at the shown block and the
additional locations with the existing initializeGitRepo helper. Pass the
temporary repository root and preserve each test’s fixture files and subsequent
behavior.
- Around line 1290-1332: Update the coverage loop in the guardrail test to
assert at least one runTrackedInitMutation call per automatic onboarding
section, rather than exact call and scope token counts. Keep the existing
negative assertions for manual waits, device runs, and project builds, along
with the native-reset regex checks, unchanged.
- Around line 1172-1219: Wrap each of the three onboarding tests beginning with
“tracked init mutation persists changed process...” in a try/finally block,
placing the existing test body in try and moving beginFreshInitProgress() into
finally. Ensure the shared state reset runs even when assertions or mutations
fail, matching the cleanup pattern used by the nearby gate tests.

In `@docs/superpowers/specs/2026-08-11-cli-onboarding-git-fingerprints-design.md`:
- Around line 51-55: Update the helper example in the specification to use the
shipped runTrackedInitMutation(operation, options) wrapper instead of
trackInitGitChanges. Include the options object with startDir, scope, and
isSuccess: result => result.success, preserving the automatic mutation and
success-predicate behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 01f4aedb-b2b4-4e0a-a5b1-db637bf80dc4

📥 Commits

Reviewing files that changed from the base of the PR and between e9ca631 and f565858.

📒 Files selected for processing (3)

cli/src/init/command.ts
cli/test/test-init-guardrails.mjs
docs/superpowers/specs/2026-08-11-cli-onboarding-git-fingerprints-design.md

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Cap-go/capacitor-updater (manual)

cubic-dev-ai

1 issue found across 3 files

Confidence score: 3/5

In cli/src/init/command.ts, the porcelain-v2 status parsing appears to reject valid submodule records as malformed, which can trap onboarding in a status-error retry loop when submodules are dirty. Treat submodule records as ordinary dirty entries in this path so initialization can proceed instead of repeatedly failing.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cli/src/init/command.ts">

<violation number="1" location="cli/src/init/command.ts:821">
P2: Dirty Git submodules make onboarding get stuck in the status-error retry loop because valid porcelain-v2 submodule records are rejected as malformed. Parsing submodule records as ordinary dirty entries (while leaving them unrecognized for fingerprint skipping) would preserve the fail-closed behavior without blocking the continue-anyway path.</violation>
</file>

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic}

cubic-dev-ai · 2026-08-11T19:14:40Z

+      return undefined
+    const [, rawStatus, submodule, headMode, indexMode, worktreeMode, headObjectId, indexObjectId, filePath] = fields
+    const status = normalizeInitGitStatus(rawStatus)
+    if (!status || !filePath || submodule !== 'N...'


P2: Dirty Git submodules make onboarding get stuck in the status-error retry loop because valid porcelain-v2 submodule records are rejected as malformed. Parsing submodule records as ordinary dirty entries (while leaving them unrecognized for fingerprint skipping) would preserve the fail-closed behavior without blocking the continue-anyway path.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cli/src/init/command.ts, line 821: <comment>Dirty Git submodules make onboarding get stuck in the status-error retry loop because valid porcelain-v2 submodule records are rejected as malformed. Parsing submodule records as ordinary dirty entries (while leaving them unrecognized for fingerprint skipping) would preserve the fail-closed behavior without blocking the continue-anyway path.</comment> <file context> @@ -329,17 +418,699 @@ export function getGitRepoStatus(startDir = cwd()): GitRepoStatus { + return undefined + const [, rawStatus, submodule, headMode, indexMode, worktreeMode, headObjectId, indexObjectId, filePath] = fields + const status = normalizeInitGitStatus(rawStatus) + if (!status || !filePath || submodule !== 'N...' + || !hasValidInitGitStatusMetadata([headMode, indexMode, worktreeMode], [headObjectId, indexObjectId])) + return undefined </file context>

Fixed in commit bd9e81f. Valid porcelain-v2 dirty-submodule markers are accepted for live status display and prompting, while snapshot capture still rejects them as unrecognized. A real-submodule regression proves the user reaches Continue instead of the status-error retry path.

cursor

Risk: medium. Left a non-blocking comment — this CLI onboarding git-fingerprint/resume change remains above the low-risk auto-approval threshold, and Cursor Bugbot was not present after the first checks poll. Human review is already requested; no additional reviewers assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cubic-dev-ai

All reported issues were addressed across 3 files (changes from recent commits).

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

sonarqubecloud · 2026-08-12T06:49:29Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

WcaleNieWolny added 16 commits August 11, 2026 15:31

docs(cli): design onboarding git fingerprints

c14d2b5

fix(cli): add onboarding git fingerprint helpers

5e8e2c7

test(cli): cover deletion after saved git fingerprint

33aa59c

fix(cli): harden onboarding git fingerprints

ad2b10d

perf(cli): batch onboarding git fingerprint metadata

fae9bf4

fix(cli): recognize saved onboarding git changes

9d66124

test(cli): exercise onboarding git resume guardrails

7c7405f

fix(cli): harden onboarding git resume state

61e15ef

fix(cli): track automatic onboarding git changes

c466f09

fix(cli): scope onboarding git tracking

eb1dd95

fix(cli): reset configured native platform path

9ca4645

fix(cli): canonicalize native reset target

fd5e4af

fix(cli): reject dangling native reset links

cf5bd3d

fix(cli): harden onboarding git snapshots

e859ca5

fix(cli): fail closed on progress persistence

c55e226

docs(cli): align onboarding fingerprint design

f565858

WcaleNieWolny deployed to deepsec-pr August 11, 2026 18:59 — with GitHub Actions Active

cursor Bot reviewed Aug 11, 2026

View reviewed changes

cursor Bot requested review from Dalanir and riderx August 11, 2026 19:00

coderabbitai Bot added the codex label Aug 11, 2026

coderabbitai Bot requested changes Aug 11, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Aug 11, 2026

View reviewed changes

WcaleNieWolny added 2 commits August 11, 2026 21:59

fix(cli): harden onboarding git guardrails

bd9e81f

fix(cli): address onboarding fingerprint review

0ad364c

WcaleNieWolny deployed to deepsec-pr August 12, 2026 06:25 — with GitHub Actions Active

cursor Bot reviewed Aug 12, 2026

View reviewed changes

coderabbitai Bot approved these changes Aug 12, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread cli/src/init/command.ts

fix(cli): bound onboarding fingerprint reads

72917bc

WcaleNieWolny deployed to deepsec-pr August 12, 2026 06:44 — with GitHub Actions Active

Uh oh!

Uh oh!

Conversation

WcaleNieWolny commented Aug 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codspeed-hq Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

WcaleNieWolny Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 12, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

WcaleNieWolny commented Aug 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

codspeed-hq Bot commented Aug 11, 2026 •

edited

Loading

WcaleNieWolny Aug 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading