feat: [kit] add CI/CD Diagnosis Agent. - #311
Open
pawanchhimwal wants to merge 26 commits into
Open
Conversation
… size limit bump, and backend bug fixes
…ated Log Retrieval, Copilot Workspace, Team Command Center, Production Hardening, Open Source Governance, and Autonomous AI Recovery Agent)
…o match registered domain
…health status dynamically
…-friendly error message
Added a link to the CI/CD diagnosis tool in the README.
Contributor
|
Warning Review limit reached
Next review available in: 59 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (48)
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughChangesCI/CD Diagnosis Agent
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
pawanchhimwal
marked this pull request as draft
July 31, 2026 16:58
pawanchhimwal
marked this pull request as ready for review
July 31, 2026 16:59
pawanchhimwal
marked this pull request as draft
July 31, 2026 16:59
pawanchhimwal
marked this pull request as ready for review
July 31, 2026 17:04
pawanchhimwal
marked this pull request as draft
July 31, 2026 17:05
pawanchhimwal
marked this pull request as ready for review
July 31, 2026 17:19
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 114
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/pull_request_template.md:
- Around line 1-15: Update the pull request template to make verification checks
conditional on the change type instead of requiring application checks for every
pull request. Add separate application and kit sections, with the kit checklist
covering README.md, agent.md, the apps/ application contract, lamatic.config.ts
project metadata, and local validation.
In `@CHANGELOG.md`:
- Line 10: Insert a single blank line after the “### Added” heading in
CHANGELOG.md and before its bullet list to satisfy markdownlint MD022.
In `@docs/api-documentation.md`:
- Around line 105-110: The Execution Steps documentation inaccurately says the
service isolates a single failing step log. Update the step describing log
processing to state that extractAndNormalizeLogs prioritizes and merges logs
from files with failure indicators, while assigning only the first matching file
to failingStepName; leave the remaining documented behavior unchanged.
- Around line 9-13: Update the GET /api/health documentation and implementation
to bound public access by adding rate limiting or caching, and remove or guard
the Lamatic health check before release. Ensure the health probe actually
validates the configured LAMATIC_API_URL endpoint instead of only reading its
configuration, while preserving the documented authentication behavior if
applicable.
- Around line 37-49: Align the GitHub authentication endpoint documentation with
the route structure represented by the login, callback, and session route
handlers: document `/api/auth/github/login`, `/api/auth/github/callback`, and
`/api/auth/github/session` with their correct methods and behavior. Do not leave
references to the nonexistent `/api/auth/github` or
`/api/auth/github/disconnect` endpoints unless compatibility routes are
explicitly added.
In `@docs/architecture-documentation.md`:
- Around line 38-50: Update the “10-Node Lamatic AgentKit Workflow Flow” list to
include the missing Planner and Output Formatter nodes, documenting each node’s
inputs and outputs consistently with the existing entries so the workflow
contains all 10 specialized nodes.
In `@docs/architecture.md`:
- Around line 26-36: Update docs/architecture.md lines 26-36 and 320-350 and
docs/testing-strategy.md lines 101-106 to document the implemented synchronous
JSON contracts for /api/diagnose and /api/github/diagnose: remove upload/job-ID
creation and polling references, describe direct diagnosis responses, align API
schemas accordingly, and update tests to validate these routes and response
contracts. Do not add asynchronous behavior unless choosing instead to implement
the documented upload and polling service.
- Around line 551-554: Update the Deployment Architecture diagram’s Redis
storage node to match the repository’s implemented persistence model, using the
actual AgentKit job-state storage symbol if available; otherwise label Redis
explicitly as future architecture rather than current storage. Keep the existing
Pinecone relationship unchanged.
In `@docs/deployment-guide.md`:
- Around line 42-56: Update the Dockerfile example in the deployment guide for
the CI/CD diagnosis agent so it no longer unconditionally copies the absent
/app/public directory; remove that COPY step unless the kit is updated to
provide the required public assets.
In `@docs/engineering-retrospective.md`:
- Around line 168-170: Update the “CI/CD Diagnosis Agent: Post-Mortem & Lessons
Learned” heading in the “One-Page Lessons Learned (Internal Summary)” appendix
to use the correct hierarchy by changing it from H3 to H2, or add the missing H2
section level.
- Around line 41-43: Use evidence_cited as the single canonical evidence field
across the pipeline: update the documentation at
docs/engineering-retrospective.md lines 41-43, define evidence_cited for the
producer at docs/implementation-plan.md lines 78-85, and map the frontend to
evidence_cited at docs/integration-architecture.md lines 132-133.
In `@docs/github-integration-architecture.md`:
- Around line 198-200: Update the “In-Memory Extraction Pipeline” design to
enforce archive safety while buffering: apply a response-size limit before
allocating the complete ArrayBuffer, and validate entry count, each entry’s
uncompressed size, and cumulative uncompressed size before or during extraction.
Ensure oversized compressed responses and central directories are rejected
before they can exhaust memory, while preserving the 10 MB total-unpacked limit.
- Around line 154-158: Update the OAuth Scopes section to accurately describe
repo as granting broad read/write access to public, private, and internal
repositories, rather than read-only access. Preserve the existing ADR-001
context about upgrading to fine-grained GitHub App permissions, and document
that using this scope requires full approval if appropriate.
- Around line 144-152: Complete the PKCE flow described in the GitHub OAuth
architecture: update the authorization request to include the generated
code_challenge and update the access-token exchange in the callback verification
flow to include the stored code_verifier. Ensure the documented state cookie
continues storing the verifier for use during the exchange.
In `@docs/implementation-plan.md`:
- Around line 159-171: Update the “Independent Testing & 7. Mock Data” plan so
unit tests mock the LLM provider boundary instead of sending the mock JSON
strings to a live LLM API. Reserve live-model validation for a small integration
suite using recorded fixtures and schema assertions, while retaining the
existing classifier and RCA expected behaviors.
- Around line 67-75: Use a single canonical retrieval result key across both
documents: in docs/implementation-plan.md lines 67-75, define the output key for
Knowledge Retrieval, and in docs/lamatic-workflow.md lines 65-68, update the
conditional expression to reference that same key instead of Knowledge.results.
- Around line 218-222: Update the debug-output requirements in
docs/implementation-plan.md lines 218-222 and docs/lamatic-workflow.md lines
114-118 so raw agent traces are returned only when a privileged authenticated
request passes server-side enablement and the production kill switch; require
redaction before exposure and document that both the API debug flag and
_debug_trace field follow these controls.
- Around line 89-98: Standardize the fix payload on resolution.fix_snippets and
define its canonical item schema in docs/implementation-plan.md lines 89-98,
replacing the generator’s fixes field while preserving the documented
manual_intervention behavior. Update the frontend mapping in
docs/integration-architecture.md lines 134-135 to consume
resolution.fix_snippets; both documented sites require changes.
- Around line 111-120: Normalize the risk contract across all referenced
documentation: in docs/implementation-plan.md lines 111-120, define one
canonical risk field and enum using consistent Low/Medium/High values; update
docs/lamatic-workflow.md lines 69-72 to route using that field; and update
docs/integration-architecture.md lines 130-131 to map the frontend from the same
canonical field.
- Around line 56-63: Define a single Planner JSON contract across all affected
documentation: in docs/implementation-plan.md lines 56-63, make the producer
schema authoritative with the agreed queries array and filters shape; in
docs/knowledge-architecture.md lines 137-144, update the retrieval example to
consume that exact schema; and in docs/lamatic-workflow.md lines 97-102,
represent queries as a JSON array and perform deduplication in code rather than
using Set or alternate query/filter shapes.
- Around line 45-53: Canonicalize classifier categories and fallback behavior
across all three documentation sites: in docs/implementation-plan.md lines
45-53, define the single canonical enum, hierarchical mapping, and fallback
value; in docs/knowledge-architecture.md lines 34-35, map knowledge folders to
those canonical classifier values; and in docs/lamatic-workflow.md lines 25-27,
replace the unsupported Unknown fallback with the canonical fallback defined by
the classifier schema.
In `@docs/integration-architecture.md`:
- Around line 195-200: Update the Environment Variables entry in the Deployment
section to use the single workspace variable name established by .env.example
and the client configuration, replacing the inconsistent LAMATIC_WORKSPACE
reference with LAMATIC_WORKSPACE_ID.
- Line 10: Resolve the inconsistent authentication posture across the
documentation: in docs/integration-architecture.md:10-10, require authentication
for the integration or explicitly mark the deployment internal-only; in
docs/lamatic-workflow.md:244-251, align the workflow checklist with the verified
authentication implementation; and in
docs/open-source-and-challenge-readiness-report.md:12-12, update the security
score only after authentication has been verified. Use the documented
implementation as the source of truth.
- Around line 19-37: Align the diagnosis route contract across both documents:
in docs/integration-architecture.md lines 19-37, use the canonical public upload
and polling paths consistently; in docs/lamatic-workflow.md lines 7-15, update
the Lamatic entry-point route to the same /api/diagnose-based contract. Ensure
no references remain to /api/analyze or /diagnose where they describe these
routes.
In `@docs/knowledge-architecture.md`:
- Around line 179-191: Update all references to the permission document in the
security inventory and Retrieval Example 1 to use the supplied path and filename
under security/permissions/permission-denied-script.md. Also update the
corresponding ingestion identifiers so they consistently reference the corrected
document path, including the additionally affected section.
- Around line 60-69: Update the front matter template’s domain schema to include
version-control, aligning it with the existing folder structure and category
list while preserving the other domain options.
In `@docs/lamatic-workflow.md`:
- Around line 129-133: Update the Security documentation’s Knowledge Isolation
guidance to require a server-enforced organization or tenant namespace derived
from authenticated session state, rather than relying on model-selected metadata
filters. Ensure the namespace is applied outside LLM output before knowledge
searches, and add coverage validating that cross-tenant access is rejected.
In `@docs/post-submission-guide.md`:
- Around line 110-115: Update the Security Risk mitigation in the “Performance &
Security Review” section to describe generated fixes as untrusted output,
require server-side validation before use, and explicitly prohibit automatic
execution of generated code. Remove the claims that JSON output formatting or
react-syntax-highlighter provide RCE or XSS protection.
In `@docs/prompt-architecture.md`:
- Around line 104-139: Update the prompt template’s outer fenced block around
the ROLE through OUTPUT REQUIREMENTS content to use four backticks, or otherwise
indent the nested JSON example, so the inner JSON fence remains inside the
intended outer block and the closing fence is parsed correctly.
- Around line 157-164: Align the empty-knowledge behavior described in
“Grounding Strategy” and the corresponding section around the internal-knowledge
guidance. Define one explicit fallback state for insufficient knowledge, then
update both sections to use that same state consistently instead of mixing
“halt” with internal model knowledge and capped confidence.
- Around line 66-72: Update the Fix Generator section’s Outputs and Constraints
around the “Outputs” and “Constraints” entries to require a JSON object
containing a `fixes` array, with each element holding code, YAML, or Bash as a
string. Remove the conflicting instruction to output raw code, YAML, or Bash
only, while preserving the generator’s prescriptive focus.
- Around line 180-189: Align the Confidence Strategy contract with
DiagnosisSchema by either adding confidence_reasoning as an optional schema
field or removing the requirement to output it from the prompt. Ensure the
documented output fields and schema validation agree, while preserving
confidence_score behavior.
In `@docs/release-guide.md`:
- Around line 7-20: Update the repository structure and release instructions to
reference the kit-local paths under kits/ci-cd-diagnosis-agent, including
kits/ci-cd-diagnosis-agent/apps and kits/ci-cd-diagnosis-agent/.env.example. Add
the correct kit directory change before commands and make environment-file copy
instructions explicitly use the kit-local configuration path.
- Around line 199-203: Update the “Final Production Readiness Report” section so
it does not unconditionally state “GO FOR LAUNCH” while required security,
deployment, and pre-launch checks remain unresolved. Make the assessment
explicitly conditional on completing the outstanding gates, or document evidence
that each required gate has passed.
In `@docs/testing-strategy.md`:
- Around line 151-154: Update the “Tracing” guidance in “Observability
Validation” to require redacted metadata and the Lamatic job ID by default
rather than full node input/output payloads. State that full payload capture is
permitted only for controlled, short-lived debugging, while preserving the
existing error analytics requirement.
- Around line 135-140: Align the failure-injection plan’s Gemini timeout
expectation with the route’s actual 502 error contract: either document the
generic diagnostic workflow failure message or update the route to return “LLM
Provider Timeout.” for provider timeouts, ensuring the route behavior and test
assertion match.
- Around line 43-44: Update the Output Formatter testing plan to validate the
same response schema used by the API route, specifically DiagnosisSchema via
safeParse, instead of referring only to the final OpenAPI schema. If the route
relies on a generated OpenAPI contract, explicitly document that contract as the
validation target.
- Around line 21-23: Update the Log Cleaner testing strategy to validate
truncateLog’s 10,000-character limit rather than counting lines. Assert that
output preserves the expected trailing characters and add a long-line case
demonstrating truncation by character count, while retaining coverage for
timestamp stripping and graceful empty-output handling.
In `@kits/ci-cd-diagnosis-agent/.env.example`:
- Around line 1-7: Ensure kits/ci-cd-diagnosis-agent/apps/.env.example exists
with all required values from kits/ci-cd-diagnosis-agent/.env.example. Update
kits/ci-cd-diagnosis-agent/README.md lines 72-83 and agent.md lines 87-89 to
instruct users to copy or fill the app-local template, and retain the
apps/lib/lamatic-client.ts remediation reference to apps/.env.example once that
file is present.
In `@kits/ci-cd-diagnosis-agent/.gitignore`:
- Around line 1-7: Update kits/ci-cd-diagnosis-agent/.gitignore lines 1-7 to add
the *.tsbuildinfo pattern, and remove the generated
kits/ci-cd-diagnosis-agent/apps/tsconfig.tsbuildinfo file from version control.
In `@kits/ci-cd-diagnosis-agent/apps/app/api/auth/github/callback/route.ts`:
- Around line 41-57: Wrap the step 4 profile fetch and step 5 session creation
in the callback route with try/catch, including failures from
fetchGitHubUserProfile and setSession. Ensure any exception sets auth_error on
homeUrl and returns the same graceful redirect used for profile-fetch failure,
while preserving the existing success session data.
In `@kits/ci-cd-diagnosis-agent/apps/app/api/auth/github/login/route.ts`:
- Around line 21-27: Update the GitHub OAuth login flow around
getCanonicalRedirectUri and getGitHubAuthorizationUrl to prevent client-supplied
x-forwarded-host values from determining redirect_uri in deployments. Require
and validate NEXT_PUBLIC_APP_URL as the canonical origin, or validate forwarded
hosts against an explicit allowlist before constructing the authorization URL;
document the required deployment configuration if that is the chosen approach.
In `@kits/ci-cd-diagnosis-agent/apps/app/api/diagnose/route.ts`:
- Around line 8-16: Update both diagnose route handlers, POST in api/diagnose
and the corresponding POST in api/github/diagnose, to enforce request-size
limits with a bounded body reader before JSON parsing and validate the parsed
log content length afterward; do not rely solely on content-length. Call
checkRateLimit from the security rate-limit module in both routes before
invoking any Lamatic flow, preserving the existing oversized-request responses
where applicable.
In `@kits/ci-cd-diagnosis-agent/apps/app/api/github/repos/route.ts`:
- Around line 16-28: Validate the query parameters before calling
fetchUserRepositories: normalize page to a finite positive integer, clamp
perPage to the GitHub-supported range of 1–100, and accept sort only when it
matches the allowed updated, created, pushed, or full_name values, otherwise use
the default sort. Remove the unchecked type assertion and ensure only these
validated values are passed to fetchUserRepositories.
In `@kits/ci-cd-diagnosis-agent/apps/app/api/health/route.ts`:
- Around line 47-52: Update the NextResponse.json call in the health endpoint to
return HTTP 503 whenever healthPayload.status is not "healthy", while preserving
HTTP 200 for healthy responses and leaving the response body and headers
unchanged.
- Around line 12-21: Update the GitHub REST API probe in the health route’s
fetch call to enforce an explicit timeout using an AbortController or equivalent
signal, and handle the resulting abort through the existing catch path so
githubStatus becomes "unreachable" (or the intended degraded state) instead of
allowing the health request to hang.
In
`@kits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-analytics.tsx`:
- Around line 43-51: Update formatRelativeTime to detect an invalid Date before
calculating diffMins, and return a safe fallback string instead of formatting
NaN values. Preserve the existing relative-time output for valid timestamps.
- Around line 22-41: Update the repoHealthList aggregation in the useMemo
callback to compare each item.timestamp with the stored lastTimestamp for the
same repository, replacing lastTimestamp and topError whenever the item is newer
while still incrementing failureCount. Sort the resulting repository list
explicitly by recency (newest lastTimestamp first) before returning it, rather
than relying on Map insertion order.
- Around line 106-110: Update the repoHealthList.map callback to remove the
unused idx parameter and use the stable unique item.repo value as the React key
instead of the array index.
In
`@kits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-compare-modal.tsx`:
- Around line 45-55: Update the risk badge class names in the comparison modal
for both column A and column B to use the shared riskToBadgeBg mapping based on
each item's diagnosis.risk.level. Add the required import from utils and remove
the hardcoded rose and amber background/color classes, preserving the existing
badge layout and text.
- Around line 36-106: Extract the duplicated comparison-column markup into a
single local component that accepts the diagnosis item and column label,
including the risk badge styling as shared logic. Replace the separate Column A
and Column B blocks in the dashboard comparison view with two renders of this
component, preserving their respective items and labels so future layout or
content changes stay synchronized.
In
`@kits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-history-table.tsx`:
- Around line 169-231: The dashboard history row requires keyboard-accessible
activation and named controls: in dashboard-history-table.tsx lines 169-231,
replace the five cell-level onClick handlers with one focusable row activation
control, add descriptive aria-labels to the compare checkbox and bookmark
button, and set the bookmark button type to button. In
dashboard-compare-modal.tsx lines 14-33, add role="dialog" and aria-modal="true"
to the overlay, close it on Escape, and give the × button type="button" plus an
aria-label.
- Around line 124-133: Update the risk-tab list used by the dashboard history
table to be declared with as const, derive a named type for its id values, and
use that type for RiskFilter or the tab configuration so setRiskFilter receives
validated ids without the as any cast. Keep the existing tab values and
filtering behavior unchanged.
In `@kits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-metrics.tsx`:
- Around line 49-55: Update the hasHistory badge label to use a factual value,
such as the count of tracked repositories, instead of the unsupported “+100%
Verified” trend delta. Preserve the existing “0 Incidents” label for the
no-history case and keep the surrounding badge styling unchanged.
- Around line 13-28: Update the dashboard metric around successRateText,
successRateBadge, and the card label to describe the measured share of
non-High-risk diagnoses, such as “Low & Medium Risk Share,” rather than pipeline
recovery. Compute the rounded percentage once in a shared value and reuse it for
both the displayed text and the 80% badge threshold, while preserving the
existing no-history “--” and “No Data” behavior.
- Around line 30-40: The dashboard metrics use unsupported placeholder values
while labeling them as measured data. In
kits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-metrics.tsx:30-40,
update the avgSpeedText/avgSpeedBadge flow to average a persisted elapsed-time
field on DiagnosisHistoryItem, or remove the Avg AI Resolution Speed card and
its Live Measured badge. In
kits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-metrics.tsx:49-55,
replace the constant +100% Verified badge with a value computed from history,
such as the count of distinct repositories.
In `@kits/ci-cd-diagnosis-agent/apps/components/diagnosis-workspace.tsx`:
- Around line 364-374: Remove fabricated telemetry fallbacks: in
diagnosis-workspace.tsx lines 364-374, update the metaObj construction to assign
run fields directly, leaving absent branch, commit, actor, run number, and
duration values undefined; in diagnosis-workspace.tsx lines 285-296, remove the
42ms latency fallback and display “System Health: Active” when latencyMs is
absent; in workspace-export-modal.tsx lines 21-24, replace the main, beb0902,
and 142 report defaults with “unknown”.
- Line 342: The diagnoseGitHubRun callback and its prop chain use any instead of
the shared GitHubWorkflowRun contract. Update diagnosis-workspace.tsx at lines
342-342 to type diagnoseGitHubRun with GitHubWorkflowRun and import it from
`@/lib/types`; update github-connect-card.tsx at lines 13-15 to type onDiagnoseRun
with GitHubWorkflowRun and import it; update github-repo-selector.tsx at lines
9-12 to use GitHubWorkflowRun for onDiagnoseRun.
- Around line 195-267: Remove the unused ResultDashboard component and its
exclusive Badge, EvidencePanel, CodeBlock, and related helper code, unless you
instead connect ResultDashboard to the status === "done" render path so it is
actually rendered. Ensure no now-unused imports or symbols remain.
- Around line 384-397: The GitHub diagnosis flow drops the sanitized log before
it reaches the Log Explorer. Update the /api/github/diagnose response and its
diagnosis consumers, including the run handler around setResult,
diagnoseGitHubRun, and the dashboard replay path, to return and store
logResult.cleanedLog in logText while restoring GitHub diagnosis results and
metadata. Ensure WorkspaceLogViewer receives the stored sanitized log instead of
an empty rawLog.
- Around line 298-310: Update simulateSteps in diagnosis-workspace.tsx to retain
the active timeout handle and add a clearStepTimer helper that cancels and
resets it. Clear the timer on component unmount and before starting a new
diagnosis, before the final setCurrentStep(AGENT_STEPS.length) in diagnose and
diagnoseGitHubRun, and inside reset; ensure each simulation schedules subsequent
timeouts through the tracked handle.
In `@kits/ci-cd-diagnosis-agent/apps/components/github/github-connect-card.tsx`:
- Around line 40-78: Update checkSession and handleDisconnect to explicitly
handle non-ok fetch responses: set an appropriate error message while preserving
the existing connection state behavior for failed disconnects. Keep the current
success and network-error handling intact, and ensure loading is still cleared
through the existing finally blocks.
- Around line 29-32: Update the authError handling in the GitHub connection
component to treat the query-string value as an untrusted error code, not
displayable text. Map only recognized codes to fixed, predefined user-facing
messages and use a safe generic message for unknown or missing codes, while
preserving the existing URL cleanup via window.history.replaceState.
In `@kits/ci-cd-diagnosis-agent/apps/components/github/github-repo-selector.tsx`:
- Line 7: Centralize SELECTED_REPO_STORAGE_KEY in a shared storage-keys module
and import it in
kits/ci-cd-diagnosis-agent/apps/components/github/github-repo-selector.tsx
(lines 7-7). In
kits/ci-cd-diagnosis-agent/apps/components/diagnosis-workspace.tsx (lines
347-353), replace the duplicated literal with the shared key and cast the parsed
storage value to GitHubRepo.
- Around line 31-43: Update the restore effect in the GitHub repository selector
to run only on mount, preventing callback identity changes from reapplying
localStorage state after user interaction. Store the latest onSelectRepo
callback in a ref and invoke that ref during restoration, while keeping the
existing selected-repository parsing and state update behavior.
In `@kits/ci-cd-diagnosis-agent/apps/components/github/github-workflow-list.tsx`:
- Around line 29-43: The localStorage restore effect in the workflow list
re-runs when the optional onSelectRun callback identity changes, restoring a
deselected run. Update the effect around the saved-run restoration to store
onSelectRun in a ref and invoke the ref’s current callback, then reduce the
effect dependencies to repo.id while preserving the existing repo matching and
selection behavior.
- Around line 106-113: Align the “Failed First” sorting logic with the failure
filter by reusing a single failure predicate that treats both “failure” and
“timed_out” conclusions as failed. Update the sort/count logic around the
existing failure handling near lines 131–136 while preserving the current
ordering for successful and other runs.
In `@kits/ci-cd-diagnosis-agent/apps/components/system-health-modal.tsx`:
- Around line 39-55: Both modal overlays lack dialog semantics and keyboard
focus management. In
kits/ci-cd-diagnosis-agent/apps/components/system-health-modal.tsx lines 39-55
and
kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-export-modal.tsx
lines 90-101, add role="dialog", aria-modal, heading labels, Escape handling
that invokes onClose, initial focus on the close button, and focus restoration
when closing; preferably centralize this behavior in a shared Modal wrapper used
by both components.
- Around line 27-37: Update the health-monitoring useEffect and modal rendering:
require res.ok, validate the parsed payload contains the expected status and
checks.githubRestApi values before calling setData, and keep loading/error
handling safe for rejected responses. Replace the hardcoded operational text and
emerald classes in the header dot, container, banner, and probe badges with
styling and labels derived from status and githubRestApi so degraded or down
states visibly indicate failure without dereferencing missing checks.
In
`@kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-center-panel.tsx`:
- Around line 121-135: Update the evidence row divs in the
analysis.evidence_cited.map render to add role="button", tabIndex={0}, and an
onKeyDown handler that invokes onJumpToEvidence(line) for Enter or Space,
matching the existing onClick behavior.
In
`@kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-export-modal.tsx`:
- Around line 78-88: Update handleDownload to append the created anchor to the
document before triggering a.click(), then remove the anchor after the click and
defer URL.revokeObjectURL until the download has been initiated, preserving the
existing filename and export behavior.
In
`@kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-log-viewer.tsx`:
- Around line 15-18: Update the lines useMemo in the workspace log viewer to
return an empty array when rawLog is missing, preserving split log data when
present. In the terminal body rendering, display “No raw log available.” when
lines.length is zero so the header count reflects only actual log lines.
- Around line 38-48: Update the log-line processing useMemo in the workspace log
viewer to precompute each line’s error flag once, rather than invoking
isErrorLine during rendering or on every search-driven render. Introduce and
enforce a MAX_RENDERED_LINES limit on the filtered output, and display a
truncation notice when lines.length exceeds that limit while preserving the
existing search and highlighting behavior.
In
`@kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-recovery-plan.tsx`:
- Around line 18-35: Update handleCopyCommand, handleCopyPatch, and handleCopyPr
to handle the promise returned by navigator.clipboard.writeText with a catch
path, and move each corresponding copied-state update and reset timer into the
success path so the UI only reports a successful copy after the write resolves.
In
`@kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-right-panel.tsx`:
- Around line 147-155: Remove the false interactive affordance from each card
rendered by dynamicKnowledgeArticles.map: eliminate cursor-pointer and the
associated hover highlight styling from the wrapper div, leaving the article
content presentation unchanged. Do not add interaction semantics unless
implementing a real link is explicitly required.
- Around line 21-83: Rename the section that renders dynamicKnowledgeArticles so
it is clearly labeled as suggested or static guidance rather than retrieved RAG
sources. Keep the existing hard-coded article generation and rendering behavior
unchanged, and ensure the UI does not imply these entries are cited documents or
retrieval results.
In `@kits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-sidebar.tsx`:
- Around line 24-28: Replace the inline SVG in the workspace sidebar icon
container with an imported lucide-react icon, choosing the closest match such as
Activity or GitBranch. Preserve the existing sizing and cyan styling through the
component’s className, and remove the now-unused inline SVG markup.
In `@kits/ci-cd-diagnosis-agent/apps/lib/auth/github.ts`:
- Around line 78-90: Update both external requests in exchangeCodeForAccessToken
and fetchGitHubUserProfile to use a finite timeout, preferably via
AbortController or the project’s existing fetch-timeout mechanism. Handle
timeout and abort failures with controlled error behavior: return the expected
failure result from the token exchange and render the established controlled
error response for profile retrieval, without allowing the callback to hang.
- Around line 50-58: Implement PKCE across getGitHubAuthorizationUrl and
exchangeCodeForAccessToken: generate and persist a code verifier associated with
state, include its S256 code_challenge and challenge method in the authorization
parameters, then retrieve the verifier during token exchange and send
code_verifier with the code. If the flow remains state-only instead, remove the
OAuth 2.0 PKCE claim from the README.
- Line 55: Update the GitHub OAuth configuration near the scope declaration to
remove the unnecessary repo permission and request only the minimum read-only
scopes required by the GitHub routes. Prefer the least-privileged GitHub App
permissions for repository, workflow, user, and email access; retain repo only
if a concrete write-required use case is implemented and documented.
In `@kits/ci-cd-diagnosis-agent/apps/lib/auth/session.ts`:
- Around line 7-12: Update getSecretKey to remove DEFAULT_SECRET and require
process.env.SESSION_SECRET, failing startup or the session operation when it is
absent instead of deriving a key from a committed fallback. Preserve the
existing SHA-256 key derivation for configured secrets.
In `@kits/ci-cd-diagnosis-agent/apps/lib/github/log-service.ts`:
- Around line 22-29: Update the archive download flow around the fetch call and
response.arrayBuffer() to enforce a maximum archive size using the
Content-Length header, rejecting responses that exceed the configured cap before
buffering. Add an abort deadline to fetch, ensure the abort signal is
propagated, and preserve the existing successful download behavior for responses
within the limit.
- Around line 137-151: Strengthen the secret-redaction replacements in the
log-cleaning flow before truncateLog: cover GitHub token prefixes ghp_, gho_,
ghu_, ghs_, and ghr_ with open-ended token lengths, and add redaction for JWTs,
password= assignments, token= assignments, and private-key blocks. Update the
nearby truncateLog comment to state that the utility preserves the last 8000
lines.
- Around line 55-68: The extractAndNormalizeLogs function must avoid blocking
request handling and must not decode invalid ZIP bytes as text. Replace
fflate.unzipSync with asynchronous extraction via fflate.unzip wrapped in a
Promise, and update the function/result flow to await it; on extraction failure,
return the established empty/error LogExtractionResult instead of sanitizing raw
binary data.
In `@kits/ci-cd-diagnosis-agent/apps/lib/github/repos.ts`:
- Around line 51-54: Validate that the value returned by response.json() in the
repository-fetching flow is an array before calling map. If the response shape
is invalid, return the route’s established structured error response instead of
allowing rawRepos.map to throw; preserve the existing GitHubRepo mapping for
valid arrays.
- Around line 31-39: Update the authenticated GitHub fetches in
kits/ci-cd-diagnosis-agent/apps/lib/github/repos.ts:31-39,
kits/ci-cd-diagnosis-agent/apps/lib/github/workflows.ts:26-33, and
kits/ci-cd-diagnosis-agent/apps/lib/github/workflows.ts:85-92 to avoid sharing
Data Cache entries across users: either include session identity in an app-owned
cache key or disable caching for these token-scoped calls. Apply the change to
the fetch logic in fetchUserRepositories() and the corresponding workflow
repository methods, preserving their existing request behavior.
In `@kits/ci-cd-diagnosis-agent/apps/lib/github/workflows.ts`:
- Line 23: Encode owner and repo at
kits/ci-cd-diagnosis-agent/apps/lib/github/workflows.ts:23-23 and
kits/ci-cd-diagnosis-agent/apps/lib/github/log-service.ts:19-19, and encode
owner, repo, and workflowId at
kits/ci-cd-diagnosis-agent/apps/lib/github/workflows.ts:72-75 before
constructing GitHub API paths. Update the relevant Zod schemas to validate owner
and repo with GitHub-compatible name rules such as /^[A-Za-z0-9_.-]+$/ so
invalid values are rejected at the boundary.
In `@kits/ci-cd-diagnosis-agent/apps/lib/history/history-store.ts`:
- Around line 28-42: Update the history item construction in the `newItem`
initializer to use `metadata?.runNumber ?? 0`, preserving an explicit run number
of 0 and avoiding random audit values. Extend `WorkspaceMetadata` with
`commitMessage`, then populate `DiagnosisHistoryItem.commitMessage` from
`metadata?.commitMessage` instead of the fixed diagnostic string.
- Around line 44-53: Update the history persistence flow around
getDiagnosisHistory and localStorage.setItem to enforce a maximum history size
by evicting the oldest entries before saving. Replace the silent catch with
explicit failure reporting, and ensure the add-history operation does not
indicate success or return newItem as saved when storage persistence fails.
In `@kits/ci-cd-diagnosis-agent/apps/lib/observability/logger.ts`:
- Around line 15-18: Update the error formatting logic in formatLog to preserve
the stack trace for Error instances, including it in formattedError instead of
retaining only payload.error.message. Keep the existing String(payload.error)
conversion for non-Error values.
In `@kits/ci-cd-diagnosis-agent/apps/lib/recovery/recovery-engine.ts`:
- Around line 14-15: Update the estimatedSuccessRate calculation in the
recovery-engine flow to remove the artificial 85% minimum, ensuring low
diagnosis.classification.confidence_score values are represented accurately
while preserving the 99% upper bound and percentage conversion.
- Around line 108-121: Update the gitPatch construction to transform every line
of fixCode into an added patch line, preserving multi-line fixes, and derive the
hunk header’s added-line count from the actual number of fixCode lines instead
of using a fixed value. Keep the existing targetFilename and patch metadata
unchanged.
In `@kits/ci-cd-diagnosis-agent/apps/lib/security/rate-limit.ts`:
- Line 6: Update the rate-limit store around the module-level store Map and its
access logic to prevent expired RateLimitRecord entries from accumulating
indefinitely. Add periodic eviction of entries whose resetTime has passed, or
enforce an equivalent bounded/LRU policy, while preserving the existing
rate-limiting behavior for active keys.
- Line 6: Replace the module-level Map used by checkRateLimit with a shared
distributed store such as Vercel KV or Upstash Redis, using atomic rate-limit
updates so counters and expiration are enforced across instances and cold
starts. If the kit intentionally supports only single-instance self-hosted
deployments, document that deployment assumption instead.
In `@kits/ci-cd-diagnosis-agent/apps/next.config.js`:
- Around line 1-29: Update the headers returned by nextConfig.headers to include
a restrictive Content-Security-Policy covering the app’s rendered content and
OAuth session handling. Define the policy to limit script, style, image,
connection, and frame sources, while accommodating Next.js inline scripts
through an appropriate nonce or strict-dynamic strategy; keep the existing
security headers unchanged.
In `@kits/ci-cd-diagnosis-agent/apps/package.json`:
- Around line 22-23: Update the `@types/react` and `@types/react-dom` dev dependency
versions in the package configuration to match the current React 19.2.4 runtime
branch, ensuring both TypeScript declarations align with react and react-dom.
In `@kits/ci-cd-diagnosis-agent/knowledge/infrastructure/docker/exit-code-137.md`:
- Around line 11-12: Update the exit-code-137 diagnosis in the Problem Overview
to describe 137 as SIGKILL rather than automatically attributing it to OOM.
Require kernel or container evidence to classify it as an OOM kill, while
acknowledging timeout and user-initiated shutdown as other possible causes.
- Around line 35-49: Revise “Fix 1: Increase Node.js heap size” and “Fix 2: Add
Docker memory limit” to first distinguish V8 heap exhaustion from host or
container OOM using observed peak usage and configured limits. Remove the
prescriptive 4096/4g values, explain that NODE_OPTIONS only raises Node’s heap
ceiling and Docker memory flags cap available memory, and instruct sizing each
limit based on measured requirements before applying either fix.
- Line 24: Qualify the runner capacity examples instead of presenting fixed
values as universal: in
kits/ci-cd-diagnosis-agent/knowledge/infrastructure/docker/exit-code-137.md:24,
replace “typically 7 GB RAM” with a runner-class-specific example and prioritize
runtime free -h checks; in
kits/ci-cd-diagnosis-agent/knowledge/infrastructure/docker/no-space-left-on-device.md:12,
qualify “~14 GB free” by runner class while preserving runtime df -h checks.
In
`@kits/ci-cd-diagnosis-agent/knowledge/infrastructure/docker/no-space-left-on-device.md`:
- Around line 53-68: Update the Fix 3 Dockerfile runtime stage to preserve
reproducible dependency installation: copy package-lock.json from the builder
context alongside package.json and replace npm install --production with npm ci
--omit=dev. Keep the existing multi-stage build and runtime artifact copies
unchanged.
- Around line 71-73: Add disk diagnostics around the Docker build workflow: run
`df -h` before the build and add a failure-conditional diagnostic step using
`if: ${{ failure() }}` after it, so disk usage is captured when the build fails.
Update the Verification Steps to reflect both checks while retaining
confirmation that the build completes without ENOSPC.
- Around line 34-41: Update the “Free disk space” cleanup instructions to
explicitly scope removal of /usr/share/dotnet, /usr/local/lib/android, and
/opt/ghc to ephemeral GitHub-hosted runners; for self-hosted runners, require
validating that those toolchains are not needed before running the cleanup,
while preserving the existing prune and disk-report steps.
In
`@kits/ci-cd-diagnosis-agent/knowledge/languages/node/npm-peer-dependency-conflict.md`:
- Around line 51-60: Update “Fix 3: Pin a compatible version with overrides” so
it does not recommend a global React override for peer conflicts; limit
overrides to compatible transitive dependencies and direct users to upgrade
react and react-dom together when their versions must align. Remove the
unsupported “// package.json” comment from the JSON example.
In `@kits/ci-cd-diagnosis-agent/lamatic-setup.md`:
- Around line 11-15: Update the log truncation logic around the log variable to
preserve both the beginning and end of logs exceeding 10,000 characters,
ensuring early failure commands remain available alongside cleanup output.
Record that truncation occurred, while keeping shorter logs unchanged.
- Line 3: Update the 10-node DAG instructions in the workflow configuration
guide by adding the missing knowledge-retrieval node between Planner and Root
Cause Analyzer. Bind the node input to Planner’s variables.queries output,
expose its results as variables.knowledge_retrieval_results, and ensure Root
Cause Analyzer consumes that binding.
- Around line 27-44: Update the Evidence Extractor prompt to require a JSON
object containing an "evidence" array, matching the configured output schema and
existing {{variables.evidence}} binding; preserve the requirement to return
exact verbatim log lines without inference.
- Around line 167-175: Update the risk output schema to require both level and
warning, then normalize params.risk to a safe fallback before accessing its
warning property. Ensure formatting always emits a warning value even when the
risk object or warning field is absent.
- Around line 27-31: Update the prompt in the CI/CD Diagnostic Expert flow
around cleanedLog and apply trusted-data delimiters to every interpolated value,
including evidence, knowledge_retrieval_results, and generated responses used by
later prompts. Explicitly instruct the model to treat delimited content as data
only, enforce the required schema-only output, and validate each result before
passing it to the next node.
- Around line 16-18: Expand the secret-masking logic before cleanedLog is sent
to Gemini, alongside the existing AWS and ghp_ replacements. Add patterns for
github_pat_, gho_, ghu_, ghs_, and ghr_ tokens, and redact high-confidence
Authorization headers, authorization query parameters, and environment-style
secret values; add tests covering every supported token format and ensure
redaction applies to evidence and recovery output.
In `@kits/ci-cd-diagnosis-agent/lamatic.config.ts`:
- Line 34: Update the links.docs configuration in lamatic.config.ts to reference
an existing documentation file or directory, using the supplied lamatic-setup.md
or repository-level docs location instead of the nonexistent
kits/ci-cd-diagnosis-agent/docs/ path.
- Around line 32-33: Update the Vercel clone URL in the deploy configuration to
include GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, NEXT_PUBLIC_APP_URL, and
SESSION_SECRET in its env list, preserving all existing deployment variables.
In `@kits/ci-cd-diagnosis-agent/README.md`:
- Around line 40-50: Update the pipeline count in the README heading or the
Mermaid diagram so they agree: either add the two missing numbered nodes after
“8. Security Reviewer Node” or change “10-Node” to match the eight nodes
currently shown.
- Line 99: Update the GitHub OAuth endpoint entry in the API reference table to
use GET /api/auth/github/login, matching the route defined by
apps/app/api/auth/github/login/route.ts, while preserving its PKCE initiation
description and validation status.
In `@SECURITY.md`:
- Around line 26-30: Add a concrete, monitored private-reporting channel to the
“Reporting Vulnerabilities” section of SECURITY.md, replacing the vague
“security report or email” wording with the approved vulnerability-report URL or
security mailbox. Keep the existing confidentiality, acknowledgment, and
status-update guidance unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 76bf5943-302a-41dc-92a0-7db58346eeba
⛔ Files ignored due to path filters (1)
kits/ci-cd-diagnosis-agent/apps/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (79)
.github/pull_request_template.mdCHANGELOG.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdLICENSEREADME.mdSECURITY.mddocs/api-documentation.mddocs/architecture-documentation.mddocs/architecture.mddocs/deployment-guide.mddocs/engineering-retrospective.mddocs/github-integration-architecture.mddocs/implementation-plan.mddocs/integration-architecture.mddocs/knowledge-architecture.mddocs/lamatic-workflow.mddocs/open-source-and-challenge-readiness-report.mddocs/post-submission-guide.mddocs/prompt-architecture.mddocs/release-guide.mddocs/testing-strategy.mdkits/ci-cd-diagnosis-agent/.env.examplekits/ci-cd-diagnosis-agent/.gitignorekits/ci-cd-diagnosis-agent/README.mdkits/ci-cd-diagnosis-agent/agent.mdkits/ci-cd-diagnosis-agent/apps/app/api/auth/github/callback/route.tskits/ci-cd-diagnosis-agent/apps/app/api/auth/github/login/route.tskits/ci-cd-diagnosis-agent/apps/app/api/auth/github/session/route.tskits/ci-cd-diagnosis-agent/apps/app/api/diagnose/route.tskits/ci-cd-diagnosis-agent/apps/app/api/github/diagnose/route.tskits/ci-cd-diagnosis-agent/apps/app/api/github/repos/route.tskits/ci-cd-diagnosis-agent/apps/app/api/github/runs/route.tskits/ci-cd-diagnosis-agent/apps/app/api/github/workflows/route.tskits/ci-cd-diagnosis-agent/apps/app/api/health/route.tskits/ci-cd-diagnosis-agent/apps/app/globals.csskits/ci-cd-diagnosis-agent/apps/app/layout.tsxkits/ci-cd-diagnosis-agent/apps/app/page.tsxkits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-analytics.tsxkits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-compare-modal.tsxkits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-history-table.tsxkits/ci-cd-diagnosis-agent/apps/components/dashboard/dashboard-metrics.tsxkits/ci-cd-diagnosis-agent/apps/components/dashboard/team-dashboard.tsxkits/ci-cd-diagnosis-agent/apps/components/diagnosis-workspace.tsxkits/ci-cd-diagnosis-agent/apps/components/github/github-connect-card.tsxkits/ci-cd-diagnosis-agent/apps/components/github/github-repo-selector.tsxkits/ci-cd-diagnosis-agent/apps/components/github/github-workflow-list.tsxkits/ci-cd-diagnosis-agent/apps/components/system-health-modal.tsxkits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-center-panel.tsxkits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-export-modal.tsxkits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-log-viewer.tsxkits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-recovery-plan.tsxkits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-right-panel.tsxkits/ci-cd-diagnosis-agent/apps/components/workspace/workspace-sidebar.tsxkits/ci-cd-diagnosis-agent/apps/lib/auth/github.tskits/ci-cd-diagnosis-agent/apps/lib/auth/session.tskits/ci-cd-diagnosis-agent/apps/lib/github/log-service.tskits/ci-cd-diagnosis-agent/apps/lib/github/repos.tskits/ci-cd-diagnosis-agent/apps/lib/github/workflows.tskits/ci-cd-diagnosis-agent/apps/lib/history/history-store.tskits/ci-cd-diagnosis-agent/apps/lib/lamatic-client.tskits/ci-cd-diagnosis-agent/apps/lib/observability/logger.tskits/ci-cd-diagnosis-agent/apps/lib/recovery/recovery-engine.tskits/ci-cd-diagnosis-agent/apps/lib/security/rate-limit.tskits/ci-cd-diagnosis-agent/apps/lib/types.tskits/ci-cd-diagnosis-agent/apps/lib/utils.tskits/ci-cd-diagnosis-agent/apps/next-env.d.tskits/ci-cd-diagnosis-agent/apps/next.config.jskits/ci-cd-diagnosis-agent/apps/package.jsonkits/ci-cd-diagnosis-agent/apps/postcss.config.mjskits/ci-cd-diagnosis-agent/apps/tsconfig.jsonkits/ci-cd-diagnosis-agent/apps/tsconfig.tsbuildinfokits/ci-cd-diagnosis-agent/knowledge/infrastructure/docker/exit-code-137.mdkits/ci-cd-diagnosis-agent/knowledge/infrastructure/docker/no-space-left-on-device.mdkits/ci-cd-diagnosis-agent/knowledge/languages/node/npm-peer-dependency-conflict.mdkits/ci-cd-diagnosis-agent/knowledge/platforms/github-actions/yaml-syntax-errors.mdkits/ci-cd-diagnosis-agent/knowledge/security/permissions/permission-denied-script.mdkits/ci-cd-diagnosis-agent/lamatic-setup.mdkits/ci-cd-diagnosis-agent/lamatic.config.ts
- fix(history-store): remove random runNumber, cap history at 50, warn on storage failure - fix(recovery-engine): remove fake 85% floor, fix multi-line git patch format - fix(health-route): add 3s AbortController timeout to GitHub probe - fix(diagnose-route): bounded body reader, add rate limiting - fix(repos-route): validate/clamp page+perPage, whitelist sort values - fix(repos-lib): guard rawRepos is array before .map() - fix(callback-route): wrap fetchGitHubUserProfile and setSession in try/catch - fix(lamatic.config): add OAuth env vars to Vercel URL, fix docs link - docs(readme): fix node count 10->8, fix OAuth endpoint path - docs(security): add GitHub private advisory reporting URL - docs(changelog): blank line after ### Added (markdownlint MD022)
Contributor
:robot_face: AgentKit Structural ValidationNew Contributions Detected
Check Results
🎉 All checks passed! This contribution follows the AgentKit structure. |
Contributor
|
Failure recorded at 2026-08-03T09:30:35Z UTC. If this PR is not fixed within 4 weeks it will be automatically closed. |
Contributor
Contributor
|
Hi @pawanchhimwal! 👋 Before this PR can be reviewed by maintainers, please resolve all comments and requested changes from the CodeRabbit automated review. Steps to follow:
This helps keep the review process efficient for everyone. Thank you! 🙏 |
…tion checks - add constitutions/default.md to kits/ci-cd-diagnosis-agent - add flows/cicd-diagnosis.ts along with prompts/, model-configs/, and scripts/ - add apps/.env.example for kit Next.js app - move docs/ into kits/ci-cd-diagnosis-agent/docs/ to keep PR scoped strictly inside kits/ - restore repo root files to match upstream/main - consume body on GET probe in health/route.ts
Contributor
There was a problem hiding this comment.
Actionable comments posted: 20
♻️ Duplicate comments (2)
kits/ci-cd-diagnosis-agent/docs/knowledge-architecture.md (2)
60-69: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winMission directive: include
version-controlin the domain schema.The folder hierarchy and category list support
version-control, but the template at Line 64 excludes it. A Git document cannot pass the documented metadata contract. Addversion-controlto the allowed domain values or remove that domain from the hierarchy and taxonomy.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/ci-cd-diagnosis-agent/docs/knowledge-architecture.md` around lines 60 - 69, Update the frontmatter template’s domain schema to include version-control among the allowed values, keeping it consistent with the documented folder hierarchy and category taxonomy.
179-181: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winCorrect the permission-document paths.
The inventory uses
permission-denied-sh.md, and the retrieval example usessecurity/permission-denied-sh.md. The supplied document isknowledge/security/permissions/permission-denied-script.md. Update the inventory, retrieval example, ingestion identifiers, and prioritized MVP entry.Also applies to: 187-191, 240-248
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kits/ci-cd-diagnosis-agent/docs/knowledge-architecture.md` around lines 179 - 181, Update the security permission-denied document references throughout the knowledge architecture documentation: correct the inventory entry, retrieval example, ingestion identifiers, and prioritized MVP entry to use the supplied document’s actual name and directory, removing all stale permission-denied-sh references.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kits/ci-cd-diagnosis-agent/apps/.env.example`:
- Line 7: Update the startup configuration validation around getSecretKey so
production exits before session cookies are created when SESSION_SECRET is
missing, empty, or still set to its placeholder value; preserve the existing
fallback behavior outside production and ensure validation occurs before session
initialization.
In `@kits/ci-cd-diagnosis-agent/apps/app/api/health/route.ts`:
- Around line 21-25: Update the non-OK branch in the health route’s GitHub
response handling so it consumes or cancels ghRes.body before setting
githubStatus to "degraded", while preserving the existing successful-response
body consumption and degraded status behavior.
In `@kits/ci-cd-diagnosis-agent/docs/architecture.md`:
- Around line 289-316: Replace the root-level monorepo layout in
kits/ci-cd-diagnosis-agent/docs/architecture.md lines 289-316 with the actual
kit-local structure, including apps/, flows/, model-configs/, prompts/,
constitutions/, knowledge/, and docs/. Update
kits/ci-cd-diagnosis-agent/docs/release-guide.md lines 7-20 to use the same
kit-local tree, lines 25-38 to reference kit-local documentation paths, and
lines 52-57 to use kit-local setup commands and environment-file paths.
In `@kits/ci-cd-diagnosis-agent/docs/deployment-guide.md`:
- Line 33: Update the deployment guidance around the “Deploy” instruction to
remove the unsupported “Next.js 16” reference and align it with the
AgentKit-supported Next.js 14–15 range, or use an unqualified framework
description. Keep the Vercel deployment and serverless-functions guidance
unchanged.
In `@kits/ci-cd-diagnosis-agent/docs/engineering-retrospective.md`:
- Around line 21-24: The retrospective’s prompt-storage guidance must direct
prompts to Markdown files under the kit’s prompts directory, not versioned JSON
files or Lamatic storage. Update the Modularity recommendation and the related
prompt-storage text to state that Lamatic is the runtime consumer while the
source prompt files remain in kits/ci-cd-diagnosis-agent/prompts/.
In `@kits/ci-cd-diagnosis-agent/docs/github-integration-architecture.md`:
- Around line 326-330: Align the documented schema export with the runtime
reference by renaming GitHubDiagnoseRequestSchema to
GitHubDiagnoseRunRequestSchema, preserving the existing validation fields and
ensuring the documentation and route use the same exported name.
- Around line 335-370: Update the “Folder Structure” section to match the
shipped repository tree: replace github-run-list.tsx with
github-workflow-list.tsx, replace lib/github/auth-config.ts and
lib/github/client.ts with lib/auth/github.ts and lib/auth/session.ts, and
replace lib/github/log-extractor.ts with lib/github/log-service.ts. Preserve the
surrounding structure and descriptions where applicable.
In `@kits/ci-cd-diagnosis-agent/docs/implementation-plan.md`:
- Around line 137-139: Choose a single temperature value for the Fix Generator
and apply it consistently across the model configuration, its prompt template,
related tests, implementation-plan and post-submission-guide documentation, and
lamatic-workflow documentation. Preserve the 0.0 contract for other LLM nodes
and ensure all Fix Generator references use the selected value.
- Around line 78-83: Standardize the root-cause evidence citation field on one
canonical key across the diagnosis agent. Update the Root Cause Analyzer
contract and every related schema, prompt, formatter, and frontend mapping to
use the same key, replacing inconsistent references to cited_evidence or
evidence_cited while preserving the existing evidence-subset validation.
In `@kits/ci-cd-diagnosis-agent/docs/knowledge-architecture.md`:
- Around line 211-217: Update the “Schema Valid” acceptance criterion in the
Quality Standards section to align with the document template and retrieval
strategy: require both severity and last_updated alongside the existing
frontmatter fields, or consistently mark them optional in all related
definitions.
- Around line 143-145: Unify the retrieval limit described in the “Top-K
Selection” step and the mitigation table so both specify the same single chunk
cap. Update the conflicting 3–5 range and table limit consistently, preserving
the surrounding retrieval workflow and context-token constraint.
- Around line 60-104: Update the outer Markdown code fence enclosing the
knowledge-architecture template to use a delimiter longer than the nested
three-backtick fences, such as four backticks. Keep the inner fences around the
text and implementation examples unchanged so the full template renders as one
code block.
In `@kits/ci-cd-diagnosis-agent/docs/lamatic-workflow.md`:
- Around line 122-125: Update the Performance Optimisation documentation to
accurately reflect the execution graph declared by the flow, including the
actual sequence through triggerNode_1, codeNode_sanitize, and
InstructorLLMNode_analyzer. If the documented Fix Generator, Fix Verifier, Risk
Reviewer, and downstream connections describe a planned or Studio-only
deployment, explicitly label them as such; otherwise update the exported flow
edges so the documented L5 → L6/L7 → F1 DAG matches the implementation.
In
`@kits/ci-cd-diagnosis-agent/docs/open-source-and-challenge-readiness-report.md`:
- Around line 21-25: Fix the broken reference in the readiness checklist by
either updating the documentation link to the existing submission/demo guide
path or adding the missing guide at docs/demo-script-and-submission-guide.md.
Ensure the checklist entry resolves to a valid guide before release.
In `@kits/ci-cd-diagnosis-agent/docs/post-submission-guide.md`:
- Around line 16-17: Update the “Why Planner & Verifier?” section to describe
the Planner as narrowing retrieval through targeted semantic searches based on
classification, not as preventing RAG database poisoning. Remove the unsupported
poisoning-prevention claim and keep corpus integrity, document ingestion, and
tenant isolation controls documented separately if applicable.
- Around line 110-114: Update the Evidence Extractor pre-filter guidance in
“Performance & Security Review” to preserve all documented failure markers,
including “FATAL ERROR:” and “Killed” alongside the existing err, fail, crit,
warn, and exit terms. Alternatively, specify a bounded tail or window that
cannot discard Killed-only Exit Code 137 failures.
In `@kits/ci-cd-diagnosis-agent/flows/cicd-diagnosis.ts`:
- Around line 50-100: Align the workflow and all related contracts around the
actual implementation: in kits/ci-cd-diagnosis-agent/flows/cicd-diagnosis.ts
lines 50-100, extend nodes and edges beyond nodes/edges to implement retrieval,
analysis, patch generation, verification, security review, and output with
explicit mappings; update lines 1-4 metadata to describe that behavior. In
kits/ci-cd-diagnosis-agent/prompts/cicd-diagnosis_analyzer_system.md lines 1-1,
either remove the “verified” guarantee or connect it to a verifier result; in
kits/ci-cd-diagnosis-agent/prompts/cicd-diagnosis_analyzer_user.md lines 6-11,
require repository context and verification before requesting a verified diff.
Update kits/ci-cd-diagnosis-agent/docs/architecture-documentation.md lines 9-20
and 38-50 to match and enumerate the implemented nodes with the accurate count,
and update kits/ci-cd-diagnosis-agent/CHANGELOG.md line 15 to claim a 10-node
execution only once that graph exists.
- Around line 45-47: Add the missing cicd-diagnosis_sanitize_logs.ts flow script
at the path referenced by references.scripts.sanitize_logs and
codeNode_sanitize.values.code in cicd-diagnosis.ts, ensuring the kit resolver
and sanitizer execution can locate it.
- Around line 18-21: Update the meta.author configuration to remove the personal
email value, either by omitting the email field or replacing it with a project
alias while preserving the author metadata structure.
In `@kits/ci-cd-diagnosis-agent/prompts/cicd-diagnosis_analyzer_user.md`:
- Around line 1-4: Update the CI/CD diagnosis prompt to pass the log through a
sanitizer before interpolation, clearly delimit the resulting content as
untrusted data, and ensure the analyzer treats it only as input rather than
instructions. Add the referenced sanitizer implementation if the prompt depends
on it; otherwise remove the incomplete sanitizer reference and use an available
sanitization path.
---
Duplicate comments:
In `@kits/ci-cd-diagnosis-agent/docs/knowledge-architecture.md`:
- Around line 60-69: Update the frontmatter template’s domain schema to include
version-control among the allowed values, keeping it consistent with the
documented folder hierarchy and category taxonomy.
- Around line 179-181: Update the security permission-denied document references
throughout the knowledge architecture documentation: correct the inventory
entry, retrieval example, ingestion identifiers, and prioritized MVP entry to
use the supplied document’s actual name and directory, removing all stale
permission-denied-sh references.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c33de451-75b3-489c-b69e-f552ec6e095f
📒 Files selected for processing (24)
kits/ci-cd-diagnosis-agent/CHANGELOG.mdkits/ci-cd-diagnosis-agent/SECURITY.mdkits/ci-cd-diagnosis-agent/apps/.env.examplekits/ci-cd-diagnosis-agent/apps/app/api/health/route.tskits/ci-cd-diagnosis-agent/constitutions/default.mdkits/ci-cd-diagnosis-agent/docs/api-documentation.mdkits/ci-cd-diagnosis-agent/docs/architecture-documentation.mdkits/ci-cd-diagnosis-agent/docs/architecture.mdkits/ci-cd-diagnosis-agent/docs/deployment-guide.mdkits/ci-cd-diagnosis-agent/docs/engineering-retrospective.mdkits/ci-cd-diagnosis-agent/docs/github-integration-architecture.mdkits/ci-cd-diagnosis-agent/docs/implementation-plan.mdkits/ci-cd-diagnosis-agent/docs/integration-architecture.mdkits/ci-cd-diagnosis-agent/docs/knowledge-architecture.mdkits/ci-cd-diagnosis-agent/docs/lamatic-workflow.mdkits/ci-cd-diagnosis-agent/docs/open-source-and-challenge-readiness-report.mdkits/ci-cd-diagnosis-agent/docs/post-submission-guide.mdkits/ci-cd-diagnosis-agent/docs/prompt-architecture.mdkits/ci-cd-diagnosis-agent/docs/release-guide.mdkits/ci-cd-diagnosis-agent/docs/testing-strategy.mdkits/ci-cd-diagnosis-agent/flows/cicd-diagnosis.tskits/ci-cd-diagnosis-agent/model-configs/cicd-diagnosis_analyzer.tskits/ci-cd-diagnosis-agent/prompts/cicd-diagnosis_analyzer_system.mdkits/ci-cd-diagnosis-agent/prompts/cicd-diagnosis_analyzer_user.md
… security, prompts, and docs
Author
|
Hi @akshatvirmani , Phase 1 validation is passing, but the new Studio Runtime Validation (Phase 2) workflow is failing at Checkout PR head before my kit reaches Studio validation. The workflow reports: Refusing to check out fork pull request code from a 'workflow_run' workflow. Since this PR originates from my fork, it looks like the Phase 2 workflow's fork-checkout security restriction is being triggered. The later Studio validation steps are therefore skipped. Could you please advise whether this should be validated through the maintainer /validate flow or if any action is required from my side? Thanks! |
Contributor
|
📡 Running Studio validation — results will appear here shortly. |
Contributor
Studio Runtime Validation (Phase 2)✅ Studio validation passed. The kit loaded successfully in Lamatic Studio. This PR is ready for final review and merge. |
…dio export for Phase 2 validation
Contributor
|
📡 Running Studio validation — results will appear here shortly. |
…gs referenced by cicd flow
Author
|
/validate |
Contributor
|
📡 Running Studio validation — results will appear here shortly. |
Contributor
|
@coderabbitai review |
Contributor
|
akshatvirmani
changed the title
Contributor
|
/validate |
Contributor
|
📡 Running Studio validation — results will appear here shortly. |
Author
|
hi @akshatvirmani Refusing to check out fork pull request code from a 'workflow_run' workflow. Because checkout fails, the subsequent Studio validation steps never execute. This appears to be related to the workflow's handling of fork PRs rather than an error being returned by my agent itself. Could you please guide me on: []Whether anything needs to be done from the Lamatic/maintainer side to allow or re-run the Studio validation for my fork PR. []Whether there is anything else currently required from my side for PR #311 to become eligible for merge / receive the required passing status. []Whether I should address any remaining CodeRabbit review status before waiting for the final maintainer review. |
Contributor
|
@coderabbitai review |
Contributor
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
1. Select Contribution Type
kits/<category>/<kit-name>/)bundles/<bundle-name>/)templates/<template-name>/)2. General Requirements
kebab-caseand matches the flow IDREADME.md(purpose, setup, usage)3. File Structure (Check what applies)
config.jsonpresent with valid metadata (name, description, tags, steps, author, env keys)flows/<flow-name>/(where applicable) include:config.json(Lamatic flow export)inputs.jsonmeta.jsonREADME.md.env.examplewith placeholder values only (kits only)config.jsonnode graphs (changes via Lamatic Studio export)4. Validation
npm install && npm run devworks locally (kits: UI runs; bundles/templates: flows are valid)[kit] Add <name> for <use case>)Hi maintainers,
This PR is submitted for the AgentKit Challenge. Could you please add the
agentkit-challengelabel?Thank you!
@coderabbitai review
triggernode receives pipeline logs and repository metadata.codenode sanitizes logs and removes sensitive data.llmnode analyzes failures with Gemini 2.0 Flash.