Repository navigation
fix(http): treat watchdog interruption as deadline timeout - #309
Closed
Coding-Dev-Tools wants to merge 497 commits into
Closed
Coding-Dev-Tools wants to merge 497 commits into
Coding-Dev-Tools wants to merge 497 commits into
Conversation
fix(synthetics): keep rejection alert non-gating
- Cloud license leasing with Polar integration - Sync relay improvements for team mode - Inspector auth and webhook enhancements - Hosted email retention policies - HTTP security hardening - Dashboard v2 team audit capabilities - Release workflow improvements - Commercial manifest validation All tests passing (1606 passed, 14 skipped). Ruff clean.
Remove commercial cloud implementation from the current public tree while preserving the audited open-core boundary and compatibility fixes.
Improve graph communities and add memory demo
Publishes the public manifest boundary for Stripe-backed private cloud subscriptions. Polar remains legacy-only; no commercial implementation is added to the public repository.
Public v1.0.0 GA release metadata, validated in a clean worktree with full CI, offline evaluations, packaging, and commercial-boundary checks.
…et-validation Repair PyPI release artifact verification
…elease-artifacts Select canonical tag artifacts for release repair
* release: prepare 1.0.1 client reliability fixes * fix: align Pro billing unit with entitlement model
Remediate all 59 existing CodeQL alerts, make local path containment machine-verifiable, redact arbitrary provider errors, replace adversarial parsers, and make hosted CodeQL fail on any SARIF finding. Preserve Python 3.9 and pin the verified Ruff series.
Require complete raw-SARIF analysis, eliminate exception-detail exposure, and confine network-triggered code indexing to absolute operator-owned roots.
* Harden final v1.0.1 release gates * Fix hosted account portal default
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 3b0bd1d116c0bde30213346b22d4f634d96a2fb0 to 4187e74d05793876e9989daffde9c3e66b4acd07. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@3b0bd1d...4187e74) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4187e74d05793876e9989daffde9c3e66b4acd07 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.0 to 1.14.1. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...ba38be9) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
…63) * chore(deps-dev): bump tree-sitter-language-pack from 0.9.0 to 1.13.3 Bumps [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) from 0.9.0 to 1.13.3. - [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases) - [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md) - [Commits](xberg-io/tree-sitter-language-pack@v0.9.0...v1.13.3) --- updated-dependencies: - dependency-name: tree-sitter-language-pack dependency-version: 1.13.3 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps): keep Python 3.9 on tree-sitter-language-pack 0.9.0 tree-sitter-language-pack 1.13.3 raises Requires-Python to >=3.10, but this project declares requires-python = ">=3.9". The code/all/test extras carried no environment marker, so `pip install engraphis[code]` became a hard resolution failure on 3.9. CI cannot catch this: the only 3.9 job installs numpy and pytest and never touches these extras. Marker-gate the pin so 3.10+ gets 1.13.3 and 3.9 stays on 0.9.0, matching the `; python_version >= '3.10'` idiom already used 24 times in this file. The bump itself is API-clean: the repo uses one symbol from the library, get_parser, in backends/codegraph.py, and symbol/edge extraction is byte-identical between the two versions. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
…15.22,<0.17 (#70) * chore(deps-dev): update ruff requirement Updates the requirements on [ruff](https://github.com/astral-sh/ruff) to permit the latest version. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.16.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * chore(deps-dev): pin ruff's rule set so the 0.16 bump is behaviour-neutral Widening the ruff bound on its own turned `ruff check .` from clean into 1347 errors on unchanged code. The cause is not the bound: pyproject declared no [tool.ruff.lint] select, so the repo inherited ruff's built-in default rule set, which is not stable across minor releases -- 0.16 widened it from 59 rules to 413. Pin select to ["E4", "E7", "E9", "F"], which resolves to exactly the same 59 rules ruff 0.15.x enabled by default. Verified identical on both 0.15.22 and 0.16.0, and `ruff check .` passes clean at both ends of the supported range, so linting behaviour is unchanged and future ruff bumps stop being repo-wide breakage. Update test_ci_linter_is_bounded_to_the_verified_release_series accordingly: it asserted the old <0.16 bound, which was never the thing that actually bounded the linter. It now asserts both the bound and the pinned rule set. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
* fix: restore managed compute consent and diagnostics * fix: harden cloud sync release recovery * fix: close v1.0.1 release blockers * fix: harden hosted recovery and transport * fix: harden unconfigured cloud recovery * fix(cloud): restore hosted HTTPS on Python 3.12+ and proxied explicit ports PinnedHTTPSHandler.https_open read self._check_hostname unconditionally. Python 3.12 folded check_hostname into the SSL context: HTTPSHandler no longer keeps the attribute and HTTPSConnection no longer accepts the keyword, so every request raised AttributeError. build_pinned_https_opener replaces the default handler, so this broke Cloud Sync, session refresh, and managed compute on 3.12/3.13 -- all declared-supported interpreters. Forward the keyword only where it still exists. PinnedHTTPSConnection.set_tunnel validated the raw netloc urllib hands it, so a hosted endpoint with an explicit port behind an HTTPS proxy resolved "cloud.example:8443" verbatim, failed, and set an invalid SNI name. Split host:port with _get_hostport first, the way http.client does. Restore the legacy relay-token fallback in /sync/run: an unreadable cloud session raised immediately, so installations still authenticating with a legacy sync token went from working to a hard 409. Also raise a real OSError instead of `raise None` when the connect loop ends with no recorded error under python -O, where the assert is stripped. Nothing exercised https_open before, which is why CI stayed green on 3.12; both new tests fail against the previous code and pass against this one. * fix(cloud): retry every vetted tunnel address and normalize state-mount I/O Two review findings from the automated re-review of eaf68e9. set_tunnel pinned only the first vetted address for CONNECT while the direct path retried all of them. A dual-stack endpoint whose first address is unreachable from the proxy therefore failed every hosted request with no fallback. Keep the whole vetted list and retry it, redialing the proxy each attempt because a failed CONNECT leaves the socket unusable. UnicodeError is caught alongside OSError: http.client idna-encodes the tunnel host, which fails on a bare IPv6 literal -- a reason to try the next address rather than abort. access_for_workspace's preflight calls configured() -> _load() before _refresh_lock() can normalize filesystem failures, and _load caught UnsafeStateFile but not plain OSError. An unreadable or stale state mount escaped as an unhandled exception and became an opaque 500, contrary to the behaviour the surrounding comment claims. Convert those to CloudSessionError at the source so every caller benefits, and correct the comment, which described a "connect first" response the code never produced for I/O failures. * fix(cloud): track the CONNECT authority per retry and restore the offline gate Two further review findings, both verified before fixing. Python 3.12 caches an authority in _tunnel_headers["Host"] when set_tunnel runs (3.11 does not -- confirmed against both interpreters). The retry loop added in 713e2db reassigned _tunnel_host but left that header pinned to the first address, so a strict proxy would reject the retry as a Host/authority mismatch. Rebuild the header for each target, with IPv6 bracketing. AGENTS.md documents `python -m pytest tests/ -q` as a fully offline gate, but relay and cloud URL validation resolve their destination to reject private/reserved targets, so the suite silently required working DNS. With DNS blocked it failed five tests, not the one the review named: the sync-token fail-closed test plus four in test_provider_error_redaction.py and test_relay_device_credentials.py. Stub getaddrinfo in the suite-wide isolation fixture; tests needing a specific resolution result still override it. Verified green with DNS blocked, and the security behaviour of resolving at validation time is unchanged. * fix(cloud): bracket IPv6 CONNECT targets on Python 3.9 and 3.10 Verified against four interpreters before changing anything. Python 3.11 and 3.12 wrap the tunnel host with _wrap_ipv6 and already emit `CONNECT [2606:...]:443`, but 3.9.25 and 3.10.20 serialize _tunnel_host verbatim and emit `CONNECT 2606:...:443` -- an ambiguous authority strict proxies reject. This package supports 3.9, so normalize the target ourselves; 3.11+ leave an already-bracketed value untouched, so one code path is correct everywhere. The new test drives the real http.client._tunnel over a fake socket and asserts the request line, so it covers whichever serialization the interpreter uses. All of 3.9.25, 3.10.20, 3.11.15 and 3.12.10 now emit the bracketed form. Also corrects a comment added in 713e2db: encoding a bare IPv6 tunnel host does not raise, so the UnicodeError guard is defensive rather than the IPv6 handler the comment claimed. * fix(dashboard): show the consent prompt on the Overview analytics card Managed-compute consent now defaults to off, so a default installation's Overview immediately calls /analytics and gets the new 409 consent_required. Only the full Analytics view routed that through managedConsentRequired()/managedConsentHtml(); the Overview fell through to the generic branch and rendered an opaque "managed cloud operation failed" string -- the worst first-run experience for exactly the new default. Mirror the Analytics handling in loadOverviewAnalytics so the card shows the opt-in instructions and a CLOUD pill instead. Reuses the existing s87 style token, so scripts/externalize_dashboard_assets.py reports no CSP drift. * fix(cloud): keep hosted connections visible to Python audit hooks http.client.HTTPConnection.connect raises the http.client.connect audit event before opening its socket, which is how a host process records or blocks outbound connections. PinnedHTTPSConnection overrides connect() and calls _create_connection directly on both the direct and proxy paths, so it never raised that event: every hosted request -- Cloud Sync, session refresh, managed compute -- was invisible to those hooks, silently and with no way to notice. Measured with a real audit hook on 3.11.15 and 3.12.10: stock HTTPSConnection raised 1 event, the pinned client raised 0 on both paths. It now raises 1 on each, matching stock. The direct path names the vetted address actually dialled rather than the hostname, so a hook deciding by address sees the destination the socket really opens; the proxy path names the proxy, which is the socket a tunnelled request actually opens and what stock audits in the same situation. Each retry is audited, so the event count tracks real dials.
…Grype release gate (#285) * fix(deps): bump certifi from 2026.7.22 to 2026.10.19 in /eval/configs Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.7.22 to 2026.10.19. - [Commits](certifi/python-certifi@2026.07.22...2026.10.19) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.10.19 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * fix(release): bump Dockerfile python:3.11-slim digest to 3.11.17 for CVE-2026-19445/19553 * fix(release): bump release-constraints setuptools to 84.1.0 for GHSA-xmj3-9gf7-h52w --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ck leaks (fixes #286) (#287) * fix(mcp): recover from DatabaseError, stale files, and transaction lock leaks - Add safe exception marker extraction in mcp_server logging to attribute underlying SQLite errors (SQLITE_CORRUPT, SQLITE_BUSY, SQLITE_LOCKED, SQLITE_IOERR, SQLITE_NOTADB, write_lock_timeout) without leaking SQL, paths, credentials, or memory content (Issue #286). - Prevent transaction lock leak in _SerializedConnection._finish when rollback fails, avoiding 60s timeout deadlocks across threadpool workers. - Add Store.is_stale() and Store.reconnect() to detect when the SQLite database file was replaced or modified out-of-process and cleanly re-initialize connection pragmas, unicode function, and snapshot pools. - Add auto-recovery and single-retry loops on DatabaseError/OperationalError in Store memory fetchers, engraphis_recall_context, engraphis_recall, engraphis_recall_grounded, and engraphis_get_memory. - Add comprehensive regression and unit tests in tests/test_mcp_database_error_recovery.py. * fix(typecheck): ensure Store.get_memories returns on all code paths * docs: refresh public offline evidence artifact for Issue #286 recovery fixes
…work - Add the dependency-free stdio MCP bridge so desktop clients share one warm engine - Add desktop-memory evaluation and closure/session-lineage test coverage - Update recall, store, sync, dashboard, and MCP internals for governed temporal history, session lineage, and deterministic measurements - Refresh documentation, benchmark evidence, and local browser-auth behavior - Record the 1.7.10 candidate changelog and version markers Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
- Bump package, plugin, and commercial-manifest versions to 1.7.12 - Record the 1.7.12 changelog entry for the stdio bridge, desktop-memory evaluation, and history-integrity work - Refresh Claude plugin asset checksums Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
- Promote the local RAM tester into tools/ram_probe.py with argparse entry points, a Windows guard, and a docstring - Verify constant patterns in bounded windows so checking never doubles the resident allocation, and cap walking/random windows explicitly - Report worker, pass, offset, expected value, and XOR diff on a mismatch Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
* fix(ci): clear the Pi extension audit gate Bump the Pi test host to @earendil-works/pi-coding-agent 1.4.0 and pin the patched undici and minimatch leaves with package.json overrides. The shrinkwrap now resolves to fixed versions, so the post-install leaf repair and its version assertions are neither needed nor valid. Verified locally: npm ci --ignore-scripts, npm run verify, npm run test:integration, npm audit --omit=dev, and npm audit --no-package-lock --include=dev all pass with zero vulnerabilities. * test(release): track the resolved Pi dependency floors The release-floor test pinned the removed post-install repair. It now checks the overrides and dev-host pin that make the lock itself resolve patched minimatch and undici, and that CI no longer rewrites node_modules before auditing. * docs(pi): drop the obsolete post-install dependency repair The lock resolves the patched leaves through package.json overrides, so the development steps no longer rewrite the installed host. * docs(pi): normalize README line endings Keep the file byte-compatible with the repository copy so the dependency-repair documentation change reviews as prose only. --------- Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com>
* fix(ci): clear the Pi extension audit gate Bump the Pi test host to @earendil-works/pi-coding-agent 1.4.0 and pin the patched undici and minimatch leaves with package.json overrides. The shrinkwrap now resolves to fixed versions, so the post-install leaf repair and its version assertions are neither needed nor valid. Verified locally: npm ci --ignore-scripts, npm run verify, npm run test:integration, npm audit --omit=dev, and npm audit --no-package-lock --include=dev all pass with zero vulnerabilities. * test(release): track the resolved Pi dependency floors The release-floor test pinned the removed post-install repair. It now checks the overrides and dev-host pin that make the lock itself resolve patched minimatch and undici, and that CI no longer rewrites node_modules before auditing. * docs(pi): drop the obsolete post-install dependency repair The lock resolves the patched leaves through package.json overrides, so the development steps no longer rewrite the installed host. * docs(pi): normalize README line endings Keep the file byte-compatible with the repository copy so the dependency-repair documentation change reviews as prose only. * feat: salvage the mergeable work from the 1.7.12 branch The file-protection engine, Command Code hook, and supporting docs already landed on main via #270, so the 1.7.12 branch's unique remaining value is: - tests/test_mcp_memory_concurrency.py: desktop MCP concurrency regressions, ported to main's fail-fast writer admission (RuntimeError instead of a locked OperationalError); all 11 cases pass. - tools/ram_probe.py: a Windows-only RAM integrity and stress diagnostic. - run_preflight.ps1: local offline gates before pushing. The Fast/full test branch previously ran the same two-file command in both modes; the full mode now runs the suite, and the copy no longer claims a billing policy. engraphis/dashboard_assets/engraphis-graph-compat.js is deliberately not restored: main's dashboard tests assert that asset stays absent. --------- Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com>
* fix(ci): clear the Pi extension audit gate Bump the Pi test host to @earendil-works/pi-coding-agent 1.4.0 and pin the patched undici and minimatch leaves with package.json overrides. The shrinkwrap now resolves to fixed versions, so the post-install leaf repair and its version assertions are neither needed nor valid. Verified locally: npm ci --ignore-scripts, npm run verify, npm run test:integration, npm audit --omit=dev, and npm audit --no-package-lock --include=dev all pass with zero vulnerabilities. * fix(dashboard): open the dashboard automatically for every browser Remove the browser token form and the window.prompt() token exchange. The dashboard mints its HttpOnly session for any same-origin browser request that reaches it: loopback, a literal address, a single-label/mDNS name, or the host in ENGRAPHIS_DASHBOARD_URL, still gated by the custom browser header, an exact Origin/Host match, and a trusted-proxy check for forwarding headers. Machine clients and /mcp still require Authorization: Bearer ENGRAPHIS_API_TOKEN. ENGRAPHIS_BROWSER_AUTO_SESSION=0 restores the hardened token gate with one-time links: POST /api/auth/link (bearer-protected) and engraphis-dashboard --link mint a single-use code, signed with the token plus a per-process epoch, delivered in a URL fragment, valid for 15 minutes, and redeemed at POST /api/auth/handoff for a 12-hour session. Re-export the offline evidence artifact because the registry binds the hashes of every public Python source file, and refresh both rendered images. * test(release): track the resolved Pi dependency floors The release-floor test pinned the removed post-install repair. It now checks the overrides and dev-host pin that make the lock itself resolve patched minimatch and undici, and that CI no longer rewrites node_modules before auditing. * docs(pi): drop the obsolete post-install dependency repair The lock resolves the patched leaves through package.json overrides, so the development steps no longer rewrite the installed host. * docs(pi): normalize README line endings Keep the file byte-compatible with the repository copy so the dependency-repair documentation change reviews as prose only. * fix(dashboard): do not echo a configuration exception to the caller CodeQL py/stack-trace-exposure flagged the /api/auth/link error path. The value is already validated at startup; return the constant message instead. * chore(evidence): re-export the registry after the CodeQL fix The evidence registry binds the SHA-256 of every public Python source file. The stack-trace-exposure fix changed engraphis/dashboard_app.py after the previous export, so the pinned artifact no longer matched the tree. This immutable export records the final source manifest; the three fixture results are unchanged. Updated the registry constants, benchmark guide, README checksum prefix, and both rendered SVG/PNG pairs. --------- Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com>
Bumps [impeccable](https://github.com/pbakaus/impeccable) from 4.7.0 to 4.8.0. - [Release notes](https://github.com/pbakaus/impeccable/releases) - [Changelog](https://github.com/pbakaus/impeccable/blob/main/docs/RELEASE-4.4.0.md) - [Commits](pbakaus/impeccable@cli-v4.7.0...cli-v4.8.0) --- updated-dependencies: - dependency-name: impeccable dependency-version: 4.8.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.21.2 to 6.21.4. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.21.2...6.21.4) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.21.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
…ates (#291) Bumps the codeql-action group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `github/codeql-action/analyze` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) Updates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
* chore(ci): let dependabot rebase its own branches main requires branches to be up to date before merging (strict required checks), so every merge leaves the other dependency PRs behind and needs a manual update-branch plus a full CI cycle. rebase-strategy: auto keeps them current without that dance. * chore(ci): keep the dependabot config line endings stable --------- Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com>
) The dashboard no longer exchanges a deployment token from a URL fragment, so the e2e specs that navigated with #token=<ENGRAPHIS_API_TOKEN> were exercising a dead path while the automatic session did the real work. Open the dashboard directly and let the shipped automatic-session path run, including the Firefox/WebKit smoke. The deliberate obsolete-fragment test in ask-home.spec.js and the mocked one-time handoff test in ledger.spec.js remain. Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com>
Guard the security-relevant ENGRAPHIS_BROWSER_AUTO_SESSION default (on) and its off switches, including the malformed-value fallback. The configuration and Playwright comments now describe the shipped behavior: token-protected API routes, automatic browser access. Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com>
Agent: antigravity
- Lead the Jev section with "included free with every paid plan: Pro and Team" - Keep the entitlement, rolling limits, fleet guard, consent, and BYOK terms intact - Record the clarification under Unreleased Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com> Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
IncompleteRead and other http.client.HTTPException instances raised when the watchdog interrupts socket reads now map to TimeoutError rather than failing into generic transport errors. Agent: antigravity
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
* docs(plans): include 500 free Jev calls per day for Pro and Team - Replace the three rolling caps with one free 500-call daily allowance - State the included allowance in the README, plan comparison, configuration, MCP reference, bundled skill, env sample, and dashboard messages - Update the documentation contract to pin the policy; historical 1.7.9 notes stay unchanged Co-authored-by: CommandCodeBot <noreply@commandcode.ai> * docs(plans): announce managed Jev availability for paid plans - Replace the not-yet-available notice with live availability and enablement - Keep the 500-call daily allowance and per-call consent rules - Refresh the bundled skill checksum Co-authored-by: CommandCodeBot <noreply@commandcode.ai> --------- Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com> Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
* chore(release): prepare 1.7.12 candidate - Bump package, plugin, and commercial-manifest versions to 1.7.12 - Record the 1.7.12 changelog entry for automatic browser access, the salvaged verification tooling, and dependency/CI upkeep - Refresh Claude plugin asset checksums Co-authored-by: CommandCodeBot <noreply@commandcode.ai> * docs(readme): state Jev is free for Pro and Team up front - Lead the Jev section with "included free with every paid plan: Pro and Team" - Keep the entitlement, rolling limits, fleet guard, consent, and BYOK terms intact - Record the clarification under Unreleased Co-authored-by: CommandCodeBot <noreply@commandcode.ai> * fix(sync,manifest): record sync authorization denial and support public-offer cloud contract - Record authoritative entitlement denial when POST /api/sync/run fails with 401/402/403, and return account_url() when connected to prevent lapsed Team users from misrouting to Pro checkout - Accept schema 'engraphis-public-offer/v1' in scripts/check_commercial_manifest.py --cloud-contract to cleanly validate against engraphis-cloud - Add regression test in tests/test_sync_dashboard.py Agent: antigravity * fix(benchmark,eval): isolate offline chunking eval and refresh 1.7.12 release evidence - Ensure chunking_eval uses retention_supervisor=none so offline evaluations remain deterministic and independent of local user LLM retention settings - Export fresh immutable offline evidence artifact for 1.7.12 release - Update benchmark report images (SVG and PNG provenance chunks) - Bind new fixture digest and artifact sha256 across tests and documentation Agent: antigravity --------- Co-authored-by: coding-dev-tools <coding-dev-tools@users.noreply.github.com> Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
engraphis/http_deadline.py changed in this branch but the registered artifact still bound its previous digest, so test_benchmark_evidence.py failed on Python 3.10 through 3.14, the numpy-only 3.9 core floor, and the coverage gate. Re-record the producer digest, recompute the suite digest, and re-pin the artifact SHA in the sidecar, README, BENCHMARKS, both SVGs, both PNG provenance chunks, and the test constant. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Take main's 1.7.12 release evidence artifact for the conflicted benchmark surfaces, then rebind it to this branch's http_deadline.py change: re-record the producer digest, recompute the suite digest, and re-pin the artifact SHA across the sidecar, README, BENCHMARKS, both SVGs, both PNG provenance chunks, and the test constant. Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
Coding-Dev-Tools
force-pushed
the
main
branch
from
November 4, 2026 04:39
6c75758 to
b5b006d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Handles watchdog shutdown interruptions during chunk read by raising \TimeoutError('HTTP request deadline exceeded')\ instead of letting socket/transport errors bubble up.
Verification
Agent: antigravity