Skip to content

refactor(dashboard,cli): thread mutation context through routes, tools and CLI (5/5) - #3433

Open
gsxdsm wants to merge 5 commits into
identity/4-engine-testsfrom
identity/5-dashboard-cli
Open

refactor(dashboard,cli): thread mutation context through routes, tools and CLI (5/5)#3433
gsxdsm wants to merge 5 commits into
identity/4-engine-testsfrom
identity/5-dashboard-cli

Conversation

@gsxdsm

@gsxdsm gsxdsm commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

Stack 5/5 — 89 files. Base: identity/4-engine-tests.

Dashboard routes, CLI commands, pi extension, desktop. Stack tip is byte-identical to the reviewed full branch.

🤖 Generated with Claude Code

@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b88001ad-bdba-44f1-b92b-be31e683ec53

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR threads required mutation context through dashboard routes, CLI commands, extension tools, and desktop integrations while hardening local transport authentication.

  • Adds explicit mutation attribution across dashboard and CLI write paths.
  • Fails closed when extension caller identity is ambiguous.
  • Secures desktop-local API startup with a process token and loopback binding.
  • Adds package changesets covering the CLI behavior, identity foundation, and transport-authentication hardening.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains, and the previously reported release-versioning concern is resolved by the included CLI changeset.

Important Files Changed

Filename Overview
packages/cli/src/extension.ts Threads resolved mutation context through extension tools and preserves fail-closed handling for unresolved or ambiguous callers.
packages/dashboard/src/routes.ts Propagates mutation context through dashboard route mutations as part of the required store contract.
packages/dashboard/app/utils/appLifecycle.ts Carries the per-process desktop API token during navigation to the loopback local runtime.
packages/desktop/src/local-runtime.ts Supplies the authenticated loopback runtime URL and ephemeral desktop API token to the renderer.
.changeset/u18-stage-d-mutation-context-dashboard-cli.md Provides the required patch changeset and release summary for the published CLI and extension behavior.

Reviews (13): Last reviewed commit: "Merge remote-tracking branch 'origin/ide..." | Re-trigger Greptile

Comment thread packages/cli/src/extension.ts
@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from 404e3a8 to be439e7 Compare August 14, 2026 03:46
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from 8a1bd17 to bd706d5 Compare August 14, 2026 03:46
@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from be439e7 to a167214 Compare August 14, 2026 03:54
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from bd706d5 to 5d25a3e Compare August 14, 2026 03:54
@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from a167214 to 3129138 Compare August 14, 2026 04:01
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from 5d25a3e to 35c2777 Compare August 14, 2026 04:01
@gsxdsm

gsxdsm commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@gsxdsm

gsxdsm commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator Author

Review feedback addressed in 1fa0961294 on feature/user-accounts (the merge path, #3428).

Fixed — the findings were correct:

Finding Resolution
identityEnabled never reaches the process flag (#3429) Wired in the daemon on startup and on settings:updated. This was a real gap in my own work — identity-enabled.ts says "U5 calls this on startup and on change" and U5 never did. Failure was silent in the dangerous direction: UI reads "on", every gate stays on its disabled allow-branch.
moveTask unattributed at the merge boundary (#3430) Threaded. It was the only write in that file still on the context-free shape, so the move audited as system/unknown while the log entries either side of it carried the real actor.
captureBaseCommitSha drops run identity (#3430) Threaded at both callers — each already resolves a context for every other write on the same path.
FNXC comment documents a call that doesn't exist (#3430) Fixed, and found a second instance: an earlier bulk conversion had rewritten text inside safe-log-entry.ts's comment, corrupting the historical record of the FN-7335 bug that comment exists to explain.
ANY_MUTATION_CONTEXT accepts system:unattributed (#3432) Tightened, with proven-failing controls for the matcher itself. This was the highest-value finding — see below.

The matcher finding deserves its own note. It was exactly right, and the blast radius was real: tightening exposed 15 genuinely unattributed writes across 11 suites that the loose matcher had been passing as attributed. Those now assert UNATTRIBUTED_CONTEXT_MATCHER explicitly, so the remaining gap is countable rather than invisible. Since a wrongly-marked (actually-attributed) site fails the assertion, all-green proves the classification is right rather than merely quiet.

Not applied, with reasons:

Verification. Measured against a baseline of the same tree with these edits reverted, so pre-existing failures aren't attributed to this change: 77 failed files / 258 failed tests before → 77 / 263 after, with no file this change touches newly failing. pnpm test:gate, pnpm lint, and CLI typecheck all green. One new suite-only failure (self-healing-pending-wedge-notification) is unmodified by this change, passes in isolation, and is recorded in the observed-flakes register per the standing rule rather than quarantined on a first sighting.

@gsxdsm

gsxdsm commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator Author

Stack rebased so every chunk carries its own review fixes; the stack tip is byte-identical to the full branch (git rev-parse identity/5-dashboard-cli^{tree} == feature/user-accounts^{tree} == 1252e4a096).

One further real finding fixed (d6167be9be): rebaseNewWorktreeOntoRemote's dep type stopped at settingsOverride, so the sole production caller could not pass a run context even though createWorktree resolves one for its other writes — its skip/fetch/success/failure breadcrumbs all persisted unattributed. Notably, that parameter's own doc comment claimed it was "REQUIRED so an unwired caller is a compile error, not a silent unattributed write" while being declared optional, and the one caller was in fact unwired. The comment now describes the code rather than contradicting it.

Re-posted findings that are already fixed in the current tree (the bot re-reviewed against pre-fix line numbers):

  • workflow-merge-boundary.ts:114/:136 — there is exactly one moveTask in that file and it takes the context; verified at the current SHA.
  • worktree-git-refs.ts:149 — both callers now pass a resolved context.
  • mutation-context-matchers.ts:40 "generic matcher accepts unattributed writes" — the matcher no longer uses expect.any(String); it matches /^(?!system:unattributed$).+/ and has its own proven-failing controls.
  • extension.ts "published CLI lacks changeset" — .changeset/u18-stage-d-mutation-context-dashboard-cli.md covers this conversion; it lives in a different chunk of the split.

Still declined: the FNXC-trace requests across the executor files. All ten already carry FNXC comments and the changed blocks are mechanical propagation of a conversion documented once at its seam; ten near-identical "attribution threaded here" notes are noise, not traceability.

CI: #3428 7/7 green, #3429 6/6, #3431#3433 all green. The only red mark is the Greptile check itself, which reports its own open findings rather than a build result.

@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from 626dc8b to 6b1eba8 Compare August 15, 2026 05:46
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from bcbf289 to 4638509 Compare August 15, 2026 05:46
@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from 6b1eba8 to 2ed6e5f Compare August 15, 2026 22:55
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from 4638509 to 3127764 Compare August 15, 2026 22:56
@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from 2ed6e5f to ac4c482 Compare August 17, 2026 23:37
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from 3127764 to 8072e2a Compare August 17, 2026 23:37
@gsxdsm
gsxdsm force-pushed the identity/4-engine-tests branch from ac4c482 to ab5d8ca Compare August 23, 2026 23:14
…uired (5/5)

Fusion-Task-Id: FN-8821

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@gsxdsm
gsxdsm force-pushed the identity/5-dashboard-cli branch from 8072e2a to d66c671 Compare August 23, 2026 23:18
gsxdsm added 3 commits August 23, 2026 20:10
…entity/5-dashboard-cli

# Conflicts:
#	packages/cli/src/commands/task.ts
#	packages/cli/src/extension.ts
#	packages/dashboard/src/__tests__/routes-tasks.test.ts
#	packages/dashboard/src/routes/register-task-workflow-routes.ts
#	packages/dashboard/src/server.ts
const location = stubLocation("file:///C:/app/index.html");
stubShell({
...localReadyState,
localRuntime: { ...localReadyState.localRuntime, authToken: "fn_0123456789abcdef0123456789abcdef" },
state: "running",
baseUrl: "http://127.0.0.1:50123",
port: 50123,
authToken: "fn_0123456789abcdef0123456789abcdef",
desktopMode: "local",
activeProfileId: null,
profiles: [],
localRuntime: { state: "running", port: 50123, authToken: "fn_0123456789abcdef0123456789abcdef" },
const location = stubLocation("file:///C:/app/index.html");
stubShell({
...localReadyState,
localRuntime: { ...localReadyState.localRuntime, authToken: "fn_0123456789abcdef0123456789abcdef" },
state: "running",
baseUrl: "http://127.0.0.1:50123",
port: 50123,
authToken: "fn_0123456789abcdef0123456789abcdef",
desktopMode: "local",
activeProfileId: null,
profiles: [],
localRuntime: { state: "running", port: 50123, authToken: "fn_0123456789abcdef0123456789abcdef" },
@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

4530 finding(s)

HIGH/CRITICAL: 43 | MEDIUM: 3990 | LOW: 497

Severity Rule Location
HIGH secret-database-url .github/workflows/full-suite.yml:55
HIGH secret-generic-credential .github/workflows/full-suite.yml:56
HIGH secret-database-url .github/workflows/full-suite.yml:241
HIGH secret-generic-credential .github/workflows/full-suite.yml:242
HIGH secret-database-url .github/workflows/full-suite.yml:281
HIGH secret-generic-credential .github/workflows/full-suite.yml:282
HIGH secret-database-url .github/workflows/pr-checks.yml:214
HIGH secret-generic-credential .github/workflows/pr-checks.yml:215
HIGH secret-generic-credential .github/workflows/release.yml:522
HIGH secret-generic-credential .github/workflows/release.yml:524
HIGH secret-generic-credential .github/workflows/test-release.yml:445
HIGH secret-generic-credential .github/workflows/test-release.yml:447
HIGH secret-generic-credential docs/cli-reference.md:80
HIGH secret-generic-credential docs/signals-connectors.md:34
HIGH secret-generic-credential docs/signals-connectors.md:77
HIGH secret-generic-credential docs/signals-connectors.md:94
HIGH secret-generic-credential docs/signals-connectors.md:117
HIGH secret-generic-credential docs/signals-connectors.md:159
HIGH secret-generic-credential packages/cli/STANDALONE.md:71
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:12
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:30
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:31
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:102
HIGH secret-database-url packages/core/src/postgres/credential-redact.ts:103
HIGH secret-generic-credential packages/core/src/postgres/embedded-lifecycle.ts:843
HIGH secret-database-url packages/core/src/postgres/embedded-lifecycle.ts:1574
HIGH secret-database-url packages/core/src/postgres/pg-backup.ts:480
HIGH js-ssrf-outbound-request packages/dashboard/app/public/sw.js:651
HIGH js-ssrf-outbound-request packages/dashboard/app/public/sw.js:727
HIGH js-host-header-trust packages/dashboard/src/cli-session-ws.ts:81
HIGH js-host-header-trust packages/dashboard/src/cli-session-ws.ts:119
HIGH js-ssrf-outbound-request packages/dashboard/src/routes.ts:1836
HIGH js-host-header-trust packages/dashboard/src/server.ts:2656
HIGH js-host-header-trust packages/dashboard/src/server.ts:2683
HIGH js-host-header-trust packages/dashboard/src/server.ts:2994
HIGH js-host-header-trust packages/dashboard/src/server.ts:3164
HIGH secret-slack-webhook plugins/examples/fusion-plugin-notification/README.md:46
HIGH secret-database-url scripts/pg-test-server.mjs:200
HIGH secret-database-url scripts/pg-test-server.mjs:231
HIGH secret-database-url scripts/pg-test-server.mjs:241
HIGH secret-generic-credential scripts/sync-fusion-skill-tools.mjs:550
HIGH secret-generic-credential scripts/verify-windows-elevated-restricted.mjs:81
HIGH secret-generic-credential scripts/verify-windows-encoding-recovery.mjs:41
MEDIUM redos-nested-quantifier docs/agents.md:1710
MEDIUM insecure-temp-file packages/cli/src/__tests__/bin.test.ts:136
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:33
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:34
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:35
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:43
MEDIUM insecure-temp-file packages/cli/src/__tests__/dev-with-memory-lib.test.ts:46

…and 4480 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

# Conflicts:
#	packages/cli/src/commands/task-lifecycle.ts
#	packages/cli/src/commands/task.ts
#	packages/dashboard/src/__tests__/task-revert-route.test.ts
#	packages/dashboard/src/routes/register-task-workflow-routes.ts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants