feat: make compiled CLI the primary entry - #13
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe compiled ChangesPrimary CLI and Recovery
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant code-intel.ps1
participant bootstrap.py
participant code-intel
participant ArtifactStore
Operator->>code-intel.ps1: invoke launcher
code-intel.ps1->>code-intel.ps1: verify release binary
code-intel.ps1->>bootstrap.py: repair when required
bootstrap.py-->>code-intel.ps1: return verified release
code-intel.ps1->>code-intel: execute repository analysis
code-intel->>ArtifactStore: write artifact index
code-intel-->>Operator: return summary or JSON result
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
🧹 Nitpick comments (7)
crates/code-intel-cli/src/main.rs (6)
302-302: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
unwrap_orevaluatescurrent_dir()even when a repo path was supplied.The argument to
unwrap_oris eager, soenv::current_dir()runs (and can fail the whole invocation via?) even forcode-intel /explicit/path. Use a lazy fallback.♻️ Proposed fix
- let repo = repo.unwrap_or(env::current_dir().map_err(|error| error.to_string())?); + let repo = match repo { + Some(repo) => repo, + None => env::current_dir().map_err(|error| error.to_string())?, + };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/main.rs` at line 302, Update the repo fallback expression in the main command flow to use lazy evaluation, so env::current_dir() is only called when repo is absent and an explicitly supplied path cannot fail due to the fallback lookup.
448-468: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
first_failurereturns a map-order failure, not the causally first one.
manifest["nodes"].as_object()iteration order is theserde_jsonmap order (alphabetical by node id under the defaultBTreeMapbacking), sofailureNode/diagnosticcan point at an incidental downstream node rather than the failure operators should act on. If the manifest carries ordering (start time, DAG rank, or a run-state sequence), select on that instead — or rename to make the arbitrary selection explicit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/main.rs` around lines 448 - 468, Update first_failure so it selects the causally earliest failed node using the manifest’s available ordering metadata, such as start time, DAG rank, or run-state sequence, instead of relying on nodes object iteration order. Preserve the existing failure statuses and diagnostic/failure fallback, and return the earliest matching node and message.
271-286: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winDuplicate
--modeis silently accepted while duplicate--artifact-rooterrors.
--mode lite --mode fulltakes the last value;--artifact-root a --artifact-root bfails. Make the two consistent so operator mistakes surface the same way.♻️ Proposed fix
if flag == "--mode" { if !matches!(value.as_str(), "lite" | "normal" | "full") { return Err("--mode must be lite, normal, or full".into()); } - mode = value.clone(); + if mode_set { + return Err("duplicate --mode".into()); + } + mode_set = true; + mode = value.clone(); } else if artifact_root.replace(PathBuf::from(value)).is_some() {Declare
let mut mode_set = false;alongside the other locals.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/main.rs` around lines 271 - 286, Update the argument-parsing function around the mode and artifact-root locals to track whether --mode has already been provided, using a mode_set boolean initialized alongside the other locals. In the --mode branch, reject subsequent occurrences with the same duplicate-option error behavior as --artifact-root, while preserving the existing allowed-value validation and assignment for the first occurrence.
390-390: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNeedless borrow flagged by Clippy.
argsis already&PrimaryArgshere.♻️ Proposed fix
- let output = primary_result(&args, &result); + let output = primary_result(args, &result);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/main.rs` at line 390, Update the call to primary_result so it passes args directly rather than borrowing it again, preserving the existing result handling.Source: Linters/SAST tools
242-261: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
is_named_commandduplicates therun()dispatch table.The list mirrors the match arms in
run()(Lines 737-753). A command added there but not here silently becomes a "repo path" on the primary path. Consider deriving both from one shared const slice.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/main.rs` around lines 242 - 261, Refactor is_named_command and the run() dispatch logic to derive command recognition from one shared const slice, ensuring every dispatched command is also identified as a named command. Remove the duplicated literal list while preserving the existing command matching and repo-path behavior.
384-389: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueFull index rebuild on every primary run scales with total artifact history.
artifact_index::rebuild(&artifact_root)walks every repo and every committed run in the shared artifact root, not just the run that was just published.Operation::Incrementalalready exists inartifact_index.rsand could reuse the previousindex.json. Fine at current scale; worth revisiting before the artifact root grows.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/code-intel-cli/src/main.rs` around lines 384 - 389, Update the primary artifact-index flow around artifact_index::rebuild to use the existing Operation::Incremental path, loading and reusing index.json while adding the newly published run instead of scanning all artifact history. Keep the existing RunError mappings and artifact_index::write_index publication behavior unchanged.skills/code-intel-pipeline/scripts/bootstrap.py (1)
473-481: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winMake post-swap cleanup best-effort so a locked old tree cannot fail a successful repair.
After
payload.replace(destination)the new install is already live. Ifshutil.rmtree(replaced)raises (Windows file lock, AV handle, open process), the caller sees an exception for a repair that actually succeeded — andcode-intel.ps1'sRepair-CodeIntelturns that into exit 69. Leftover.replaced-*trees also accumulate underinstall_root.♻️ Proposed refactor
try: payload.replace(destination) except BaseException: replaced.replace(destination) raise - shutil.rmtree(replaced) + shutil.rmtree(replaced, ignore_errors=True) return destination, "repaired"Consider also sweeping stale
.replaced-*/.staging-*directories withignore_errors=Trueat the start ofinstall_releaseso retries do not leave the install root growing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/code-intel-pipeline/scripts/bootstrap.py` around lines 473 - 481, Make cleanup after the successful payload swap best-effort in the repair flow: update the post-swap shutil.rmtree(replaced) call so failures from locked old trees do not propagate, while preserving the rollback behavior for payload.replace(destination) failures. Also add an initial sweep in install_release for stale .replaced-* and .staging-* directories using ignore_errors=True.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 65-73: Add execution steps for
scripts/tests/test-primary-launchers.ps1 in both .github/workflows/ci.yml sites:
after the CLI build in the primary job and equivalently in the cross-platform
matrix job. Run the script with PowerShell rather than only parsing it,
preserving the existing parser checks and ensuring both jobs exercise
verified-release fallback and compatibility delegation.
In `@code-intel.ps1`:
- Around line 104-113: Update the Get-ChildItem invocation in the $actual
manifest enumeration to include -Force, ensuring hidden and system files plus
files under hidden directories are collected consistently with payload_manifest.
Leave the existing relative-path normalization and .code-intel-release.json
exclusion unchanged.
- Around line 37-54: Update Get-CanonicalManifestJson so its generated manifest
matches Python’s manifest_digest output exactly: preserve lowercase sha256 and
size keys, use compact separators, sort file names ordinally, and apply
equivalent ensure_ascii JSON escaping to file names. Build the canonical
UTF-8-compatible string without changing the established validation or file
ordering.
- Around line 141-162: Update Get-VerifiedReleaseRoots so prerelease directory
names such as v0.4.0-beta.1 are retained instead of skipped when [version]
parsing fails. Parse each tag into its core version and prerelease status, then
sort by descending core version with stable releases ranked ahead of prereleases
for the same core version, while preserving the existing root collection and
uniqueness behavior.
In `@crates/code-intel-cli/src/capability.rs`:
- Around line 349-365: Update the candidate construction in the manifest
discovery function so the CODE_INTEL_HOME integrations.json path is added before
any executable-ancestor candidates. Limit the ancestor fallback to the intended
trusted scope, matching the precedence and safety behavior established by
orchestration_manifest and is_safe_cwd_manifest, so writable parent directories
cannot override the explicit home configuration.
In `@crates/code-intel-cli/src/main.rs`:
- Around line 231-240: Update is_primary_invocation so an empty raw argument
list is not classified as a primary invocation, preserving the existing help
path for bare code-intel while leaving explicit route, command, and option
detection unchanged.
- Around line 369-383: Ensure the staging directory is cleaned up whether
execution succeeds or fails: replace the post-execution cleanup after
execution_kernel::execute with a small Drop-based guard created before the call,
using the existing staging_root path. Keep cleanup errors non-fatal during guard
destruction while preserving the current explicit error handling for
successful-run cleanup if required.
- Around line 1693-1726: Update FULL_HELP_TEXT to document the primary
invocation form, including the path argument and --mode, --artifact-root, and
--json options. Also update the corresponding HELP_TEXT entry so it includes
--artifact-root and --json, keeping the advertised --help --all output complete
and consistent.
In `@docs/adr/0011-primary-cli-and-recovery-launcher.md`:
- Line 3: Update the ADR frontmatter date from 2026-07-25 to the actual
acceptance date, 2026-07-24.
In `@docs/public-beta.md`:
- Around line 41-46: Update the options table near the documented code-intel
invocation to remove the stale -SkipRepowise guidance or explicitly mark it as
compatibility-only, and identify --mode lite as the current compiled CLI control
for bypassing Repowise. Keep the surrounding normal, lite, and full mode
behavior consistent with the updated usage section.
In `@invoke-code-intel.ps1`:
- Around line 33-38: Update the parameter validation around $supported and
$PSBoundParameters in invoke-code-intel.ps1 to exclude PowerShell common
parameters such as Verbose, ErrorAction, and Debug from $unsupported, allowing
them to pass through without exit code 64 while retaining rejection of unknown
compatibility options.
- Around line 71-82: Update the repository alias validation around $entry in the
RepoPath resolution block to safely inspect whether entry.Value has a path
property before dereferencing it under strict mode. Preserve the existing error
message and exit 64 behavior for missing, malformed, or blank paths, and assign
$RepoPath only after the guarded validation succeeds.
In `@orchestration/integrations.json`:
- Line 288: Add the missing toolchainDigestEvidence mapping for the second
declared doctor toolchain digest in the orchestration manifest, including the
complete digest input set rather than only doctor_adapter.rs and
capability_inventory.rs. Reuse the existing doctor evidence/input symbols and
ensure all manifest resolution inputs captured at runtime are associated with
the declared digest.
In `@README.md`:
- Line 43: Update the PowerShell scope description in README.md to include
compatibility adapter hosting alongside installation, recovery, and legacy
command forwarding, keeping it consistent with the run-code-intel.ps1 entry in
the listed adapters.
---
Nitpick comments:
In `@crates/code-intel-cli/src/main.rs`:
- Line 302: Update the repo fallback expression in the main command flow to use
lazy evaluation, so env::current_dir() is only called when repo is absent and an
explicitly supplied path cannot fail due to the fallback lookup.
- Around line 448-468: Update first_failure so it selects the causally earliest
failed node using the manifest’s available ordering metadata, such as start
time, DAG rank, or run-state sequence, instead of relying on nodes object
iteration order. Preserve the existing failure statuses and diagnostic/failure
fallback, and return the earliest matching node and message.
- Around line 271-286: Update the argument-parsing function around the mode and
artifact-root locals to track whether --mode has already been provided, using a
mode_set boolean initialized alongside the other locals. In the --mode branch,
reject subsequent occurrences with the same duplicate-option error behavior as
--artifact-root, while preserving the existing allowed-value validation and
assignment for the first occurrence.
- Line 390: Update the call to primary_result so it passes args directly rather
than borrowing it again, preserving the existing result handling.
- Around line 242-261: Refactor is_named_command and the run() dispatch logic to
derive command recognition from one shared const slice, ensuring every
dispatched command is also identified as a named command. Remove the duplicated
literal list while preserving the existing command matching and repo-path
behavior.
- Around line 384-389: Update the primary artifact-index flow around
artifact_index::rebuild to use the existing Operation::Incremental path, loading
and reusing index.json while adding the newly published run instead of scanning
all artifact history. Keep the existing RunError mappings and
artifact_index::write_index publication behavior unchanged.
In `@skills/code-intel-pipeline/scripts/bootstrap.py`:
- Around line 473-481: Make cleanup after the successful payload swap
best-effort in the repair flow: update the post-swap shutil.rmtree(replaced)
call so failures from locked old trees do not propagate, while preserving the
rollback behavior for payload.replace(destination) failures. Also add an initial
sweep in install_release for stale .replaced-* and .staging-* directories using
ignore_errors=True.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ddea4272-03cc-483f-bb83-0ebcc5fcec96
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (36)
.github/workflows/ci.yml.github/workflows/release.ymlCONTEXT.mdFind-CodeIntelProjects.ps1README.mdbootstrap-new-machine.ps1code-intel.ps1crates/code-intel-cli/Cargo.tomlcrates/code-intel-cli/src/artifact_index.rscrates/code-intel-cli/src/artifacts.rscrates/code-intel-cli/src/capability.rscrates/code-intel-cli/src/dag_run.rscrates/code-intel-cli/src/doctor_adapter.rscrates/code-intel-cli/src/main.rscrates/code-intel-cli/src/orchestration.rscrates/code-intel-cli/tests/primary_entry.rsdocs/adr/0011-primary-cli-and-recovery-launcher.mddocs/artifact-data-contract.mddocs/code-intel-architecture.mddocs/follow-up-automation.mddocs/project-management-support.mddocs/public-beta.mddocs/repository-layout.mdinstall-code-intel-pipeline.ps1invoke-code-intel.ps1orchestration/integrations.jsonorchestration/internalization/linear.jsonorchestration/internalization/llm-wiki.jsonorchestration/internalization/obsidian.jsonscripts/tests/test-primary-launchers.ps1scripts/tests/test-stable-wrapper-e2e.ps1skills/code-intel-pipeline/SKILL.mdskills/code-intel-pipeline/scripts/bootstrap.pytests/test_repository_layout.pytests/test_skill_package.pytools/Test-BetaPackage.ps1
| "code-intel.ps1", | ||
| "invoke-code-intel.ps1", | ||
| "run-code-intel.ps1", | ||
| "Invoke-ScopedRepowise.ps1", | ||
| "Find-CodeIntelProjects.ps1", | ||
| "Invoke-GitHubSolutionResearch.ps1", | ||
| "scripts/tests/test-code-intel-pipeline.ps1", | ||
| "scripts/tests/test-stable-wrapper-e2e.ps1", | ||
| "scripts/tests/test-primary-launchers.ps1", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Execute the launcher trust test, not just its parser check. scripts/tests/test-primary-launchers.ps1 is only parsed in both jobs, so regressions in verified-release fallback and compatibility delegation can merge without being exercised.
.github/workflows/ci.yml#L65-L73: add a PowerShell step that runs.\scripts\tests\test-primary-launchers.ps1after the CLI is built..github/workflows/ci.yml#L279-L287: add the equivalent execution step for the cross-platform matrix, if this launcher contract is intended to be cross-platform.
📍 Affects 1 file
.github/workflows/ci.yml#L65-L73(this comment).github/workflows/ci.yml#L279-L287
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 65 - 73, Add execution steps for
scripts/tests/test-primary-launchers.ps1 in both .github/workflows/ci.yml sites:
after the CLI build in the primary job and equivalently in the cross-platform
matrix job. Run the script with PowerShell rather than only parsing it,
preserving the existing parser checks and ensuring both jobs exercise
verified-release fallback and compatibility delegation.
| function Get-CanonicalManifestJson { | ||
| param([Parameter(Mandatory)]$Files) | ||
|
|
||
| $names = [string[]]@($Files.PSObject.Properties.Name) | ||
| [Array]::Sort($names, [StringComparer]::Ordinal) | ||
| $parts = foreach ($name in $names) { | ||
| $entry = $Files.PSObject.Properties[$name].Value | ||
| $sha256 = [string]$entry.sha256 | ||
| $size = [long]$entry.size | ||
| if ($sha256 -cnotmatch "^[0-9a-f]{64}$" -or $size -lt 0) { | ||
| throw "invalid release manifest entry: $name" | ||
| } | ||
| $encodedName = [System.Text.Json.JsonEncodedText]::Encode([string]$name).ToString() | ||
| $encodedName = "`"$encodedName`"" | ||
| "$encodedName`:{`"sha256`":`"$sha256`",`"size`":$size}" | ||
| } | ||
| return "{$($parts -join ',')}" | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Exposure check: do any tracked payload names contain characters where
# System.Text.Json default escaping diverges from Python's ensure_ascii output?
git ls-files | python3 -c '
import re, sys
names = sys.stdin.read().splitlines()
divergent = [n for n in names if re.search(r"[^ -~]|[+&<>\x27]", n)]
print("divergent names:", len(divergent))
for n in divergent[:50]:
print(" ", n)
'Repository: 2233admin/code-intel-pipeline
Length of output: 186
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg '(^|/)(code-intel\.ps1|bootstrap.py)$|json|manifest|release' || true
echo
echo "== code-intel.ps1 relevant section =="
if [ -f code-intel.ps1 ]; then
nl -ba code-intel.ps1 | sed -n '1,90p'
fi
echo
echo "== bootstrap.py manifest digest references =="
if [ -f bootstrap.py ]; then
rg -n "manifest_digest|json\.dumps|default_install_root|manifest" bootstrap.py
nl -ba bootstrap.py | sed -n '340,380p'
fi
echo
echo "== all manifest sha256 references =="
rg -n "manifest_sha256|manifest_digest|Get-CanonicalManifestJson|release manifest entry|exit 69|exit 70|Get-VerifiedReleaseBinary" -S .Repository: 2233admin/code-intel-pipeline
Length of output: 24120
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Python equivalent JSON text behavior for representative filenames =="
python3 - <<'PY'
import json
import string
samples = [
"abc",
"file+with+plus",
"file&with&ersand",
"file'with'quote",
"file<with>bracket",
"file with\ttab",
"file with\nnewline",
"file_with_unicode_ä",
"file_with_unicode_心",
]
for name in samples:
py = json.dumps({"name": name}, ensure_ascii=True, separators=(",", ":"), sort_keys=True)
print(repr(name), "->", py)
PY
echo
echo "== PowerShell JSON/encoding behavior (if pwsh is available) =="
if command -v pwsh >/dev/null 2>&1; then
pwsh -NoProfile -Command '
$samples = @("abc", "file+with+plus", "file&with&ersand", "file\x27with\x27quote", "file<with>bracket", "file_with_unicode_ä", "file_with_unicode_心")
foreach ($name in $samples) {
$encoded = [System.Text.Json.JsonEncodedText]::Encode($name).ToString()
$entry = "{\`"sha256\`":\`"aabbccdd\`",`"size\`":0}"
Write-Output ("$name -> encode=${encoded}; json={`"$($encoded)`":$entry}")
}
'
else
echo "pwsh not available; skipping PowerShell runtime probe"
fiRepository: 2233admin/code-intel-pipeline
Length of output: 1584
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== code-intel.ps1 section =="
awk '{printf "%6d\t%s\n", NR, $0}' code-intel.ps1 | sed -n '1,110p'
echo
echo "== bootstrap.py manifest digest references =="
awk '{printf "%6d\t%s\n", NR, $0}' skills/code-intel-pipeline/scripts/bootstrap.py | sed -n '340,385p'
echo
echo "== all digest / canonical references and exit codes =="
rg -n "manifest_sha256|manifest_digest|Get-CanonicalManifestJson|release manifest entry|exit 69|exit 70|Get-VerifiedReleaseBinary|ensure_ascii|sort_keys" -S .Repository: 2233admin/code-intel-pipeline
Length of output: 10691
Mirror Python’s canonical manifest JSON encoding.
manifest_digest uses json.dumps(..., ensure_ascii=True, separators=(",", ":"), sort_keys=True), where keys sha256 and size stay lowercase, while Get-CanonicalManifestJson emits uppercase sha256 and size. Any release built by bootstrap.py will fail manifest_sha256 verification and fall back to recovery. Build the PowerShell canonical string without changing key casing, e.g. use UTF-8 text construction that mirrors Python’s key order and escaping.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@code-intel.ps1` around lines 37 - 54, Update Get-CanonicalManifestJson so its
generated manifest matches Python’s manifest_digest output exactly: preserve
lowercase sha256 and size keys, use compact separators, sort file names
ordinally, and apply equivalent ensure_ascii JSON escaping to file names. Build
the canonical UTF-8-compatible string without changing the established
validation or file ordering.
Source: Linters/SAST tools
| $actual = @(Get-ChildItem -LiteralPath $rootPath -File -Recurse | ForEach-Object { | ||
| [System.IO.Path]::GetRelativePath($rootPath, $_.FullName).Replace( | ||
| [System.IO.Path]::DirectorySeparatorChar, | ||
| "/" | ||
| ) | ||
| } | Where-Object { $_ -cne ".code-intel-release.json" }) | ||
| if ($actual.Count -ne $expected.Count -or | ||
| @($actual | Where-Object { -not $expected.Contains($_) }).Count -ne 0) { | ||
| return $null | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add -Force so extra-file detection matches the Python manifest producer.
payload_manifest in bootstrap.py enumerates with rglob("*"), which includes hidden/system files and files beneath hidden directories; Get-ChildItem -File -Recurse without -Force skips them. A single hidden-attributed payload file therefore makes $actual.Count smaller than $expected.Count and silently marks a valid release untrusted on every launch.
🐛 Proposed fix
- $actual = @(Get-ChildItem -LiteralPath $rootPath -File -Recurse | ForEach-Object {
+ $actual = @(Get-ChildItem -LiteralPath $rootPath -File -Recurse -Force | ForEach-Object {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| $actual = @(Get-ChildItem -LiteralPath $rootPath -File -Recurse | ForEach-Object { | |
| [System.IO.Path]::GetRelativePath($rootPath, $_.FullName).Replace( | |
| [System.IO.Path]::DirectorySeparatorChar, | |
| "/" | |
| ) | |
| } | Where-Object { $_ -cne ".code-intel-release.json" }) | |
| if ($actual.Count -ne $expected.Count -or | |
| @($actual | Where-Object { -not $expected.Contains($_) }).Count -ne 0) { | |
| return $null | |
| } | |
| $actual = @(Get-ChildItem -LiteralPath $rootPath -File -Recurse -Force | ForEach-Object { | |
| [System.IO.Path]::GetRelativePath($rootPath, $_.FullName).Replace( | |
| [System.IO.Path]::DirectorySeparatorChar, | |
| "/" | |
| ) | |
| } | Where-Object { $_ -cne ".code-intel-release.json" }) | |
| if ($actual.Count -ne $expected.Count -or | |
| @($actual | Where-Object { -not $expected.Contains($_) }).Count -ne 0) { | |
| return $null | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@code-intel.ps1` around lines 104 - 113, Update the Get-ChildItem invocation
in the $actual manifest enumeration to include -Force, ensuring hidden and
system files plus files under hidden directories are collected consistently with
payload_manifest. Leave the existing relative-path normalization and
.code-intel-release.json exclusion unchanged.
| function Get-VerifiedReleaseRoots { | ||
| $roots = [System.Collections.Generic.List[string]]::new() | ||
| $roots.Add($PSScriptRoot) | ||
| $releases = Join-Path (Get-CodeIntelDataRoot) "releases" | ||
| if (Test-Path -LiteralPath $releases -PathType Container) { | ||
| $versioned = foreach ($directory in @(Get-ChildItem -LiteralPath $releases -Directory)) { | ||
| try { | ||
| [pscustomobject]@{ | ||
| Path = $directory.FullName | ||
| Version = [version]$directory.Name.TrimStart("v") | ||
| } | ||
| } | ||
| catch { | ||
| continue | ||
| } | ||
| } | ||
| foreach ($release in @($versioned | Sort-Object Version -Descending)) { | ||
| $roots.Add($release.Path) | ||
| } | ||
| } | ||
| return $roots | Select-Object -Unique | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Prerelease install directories are silently dropped from discovery.
bootstrap.py installs into install_root / tag, and --channel prerelease yields tags like v0.4.0-beta.1. [version]"0.4.0-beta.1" throws, the catch skips the directory, so a prerelease install is never a candidate root — the launcher instead falls into Repair-CodeIntel, which runs bootstrap.py without --channel (stable default). Prerelease users can end up re-downloading stable on every invocation.
Parse the core version separately from the prerelease suffix and rank stable ahead of prerelease for the same core version.
🐛 Proposed fix
$versioned = foreach ($directory in @(Get-ChildItem -LiteralPath $releases -Directory)) {
try {
+ $name = $directory.Name.TrimStart("v")
+ $core, $prerelease = $name.Split("-", 2)
[pscustomobject]@{
Path = $directory.FullName
- Version = [version]$directory.Name.TrimStart("v")
+ Version = [version]$core
+ IsStable = [string]::IsNullOrEmpty($prerelease)
+ Prerelease = [string]$prerelease
}
}
catch {
continue
}
}
- foreach ($release in @($versioned | Sort-Object Version -Descending)) {
+ $ordered = @($versioned | Sort-Object `
+ @{ Expression = "Version"; Descending = $true }, `
+ @{ Expression = "IsStable"; Descending = $true }, `
+ @{ Expression = "Prerelease"; Descending = $true })
+ foreach ($release in $ordered) {
$roots.Add($release.Path)
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| function Get-VerifiedReleaseRoots { | |
| $roots = [System.Collections.Generic.List[string]]::new() | |
| $roots.Add($PSScriptRoot) | |
| $releases = Join-Path (Get-CodeIntelDataRoot) "releases" | |
| if (Test-Path -LiteralPath $releases -PathType Container) { | |
| $versioned = foreach ($directory in @(Get-ChildItem -LiteralPath $releases -Directory)) { | |
| try { | |
| [pscustomobject]@{ | |
| Path = $directory.FullName | |
| Version = [version]$directory.Name.TrimStart("v") | |
| } | |
| } | |
| catch { | |
| continue | |
| } | |
| } | |
| foreach ($release in @($versioned | Sort-Object Version -Descending)) { | |
| $roots.Add($release.Path) | |
| } | |
| } | |
| return $roots | Select-Object -Unique | |
| } | |
| function Get-VerifiedReleaseRoots { | |
| $roots = [System.Collections.Generic.List[string]]::new() | |
| $roots.Add($PSScriptRoot) | |
| $releases = Join-Path (Get-CodeIntelDataRoot) "releases" | |
| if (Test-Path -LiteralPath $releases -PathType Container) { | |
| $versioned = foreach ($directory in @(Get-ChildItem -LiteralPath $releases -Directory)) { | |
| try { | |
| $name = $directory.Name.TrimStart("v") | |
| $core, $prerelease = $name.Split("-", 2) | |
| [pscustomobject]@{ | |
| Path = $directory.FullName | |
| Version = [version]$core | |
| IsStable = [string]::IsNullOrEmpty($prerelease) | |
| Prerelease = [string]$prerelease | |
| } | |
| } | |
| catch { | |
| continue | |
| } | |
| } | |
| $ordered = @($versioned | Sort-Object ` | |
| @{ Expression = "Version"; Descending = $true }, ` | |
| @{ Expression = "IsStable"; Descending = $true }, ` | |
| @{ Expression = "Prerelease"; Descending = $true }) | |
| foreach ($release in $ordered) { | |
| $roots.Add($release.Path) | |
| } | |
| } | |
| return $roots | Select-Object -Unique | |
| } |
🧰 Tools
🪛 PSScriptAnalyzer (1.25.0)
[warning] 141-141: The cmdlet 'Get-VerifiedReleaseRoots' uses a plural noun. A singular noun should be used instead.
Suggested fix: Singularized correction of 'Get-VerifiedReleaseRoots'
(PSUseSingularNouns)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@code-intel.ps1` around lines 141 - 162, Update Get-VerifiedReleaseRoots so
prerelease directory names such as v0.4.0-beta.1 are retained instead of skipped
when [version] parsing fails. Parse each tag into its core version and
prerelease status, then sort by descending core version with stable releases
ranked ahead of prereleases for the same core version, while preserving the
existing root collection and uniqueness behavior.
| let mut candidates = vec![]; | ||
| if let Ok(exe) = env::current_exe() { | ||
| if let Some(parent) = exe.parent() { | ||
| candidates.push(parent.join("orchestration").join("integrations.json")); | ||
| candidates.extend( | ||
| parent | ||
| .ancestors() | ||
| .map(|root| root.join("orchestration").join("integrations.json")), | ||
| ); | ||
| } | ||
| } | ||
| if let Some(home) = env::var_os("CODE_INTEL_HOME") { | ||
| candidates.push( | ||
| PathBuf::from(home) | ||
| .join("orchestration") | ||
| .join("integrations.json"), | ||
| ); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
CODE_INTEL_HOME is now shadowed by an unbounded exe-ancestor walk.
The ancestor candidates are pushed before the CODE_INTEL_HOME candidate, and Path::ancestors() walks to the filesystem root. Any orchestration/integrations.json in a parent of the install directory therefore wins over the operator's explicitly configured home. This inverts the precedence that orchestration_manifest in crates/code-intel-cli/src/providers.rs (lines 1225-1281) establishes — CODE_INTEL_HOME first, exe ancestors only as a fallback — and unlike the cwd branch there (is_safe_cwd_manifest) the widened walk has no trust validation. Since discover_manifest now backs dag_run::default_registry and doctor_adapter::pipeline_root, a manifest planted in a writable ancestor silently drives orchestration decisions.
🔒️ Proposed fix: keep explicit home ahead of the ancestor walk
let mut candidates = vec![];
+ if let Some(home) = env::var_os("CODE_INTEL_HOME") {
+ candidates.push(
+ PathBuf::from(home)
+ .join("orchestration")
+ .join("integrations.json"),
+ );
+ }
if let Ok(exe) = env::current_exe() {
if let Some(parent) = exe.parent() {
candidates.extend(
parent
.ancestors()
.map(|root| root.join("orchestration").join("integrations.json")),
);
}
}
- if let Some(home) = env::var_os("CODE_INTEL_HOME") {
- candidates.push(
- PathBuf::from(home)
- .join("orchestration")
- .join("integrations.json"),
- );
- }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| let mut candidates = vec![]; | |
| if let Ok(exe) = env::current_exe() { | |
| if let Some(parent) = exe.parent() { | |
| candidates.push(parent.join("orchestration").join("integrations.json")); | |
| candidates.extend( | |
| parent | |
| .ancestors() | |
| .map(|root| root.join("orchestration").join("integrations.json")), | |
| ); | |
| } | |
| } | |
| if let Some(home) = env::var_os("CODE_INTEL_HOME") { | |
| candidates.push( | |
| PathBuf::from(home) | |
| .join("orchestration") | |
| .join("integrations.json"), | |
| ); | |
| } | |
| let mut candidates = vec![]; | |
| if let Some(home) = env::var_os("CODE_INTEL_HOME") { | |
| candidates.push( | |
| PathBuf::from(home) | |
| .join("orchestration") | |
| .join("integrations.json"), | |
| ); | |
| } | |
| if let Ok(exe) = env::current_exe() { | |
| if let Some(parent) = exe.parent() { | |
| candidates.extend( | |
| parent | |
| .ancestors() | |
| .map(|root| root.join("orchestration").join("integrations.json")), | |
| ); | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/code-intel-cli/src/capability.rs` around lines 349 - 365, Update the
candidate construction in the manifest discovery function so the CODE_INTEL_HOME
integrations.json path is added before any executable-ancestor candidates. Limit
the ancestor fallback to the intended trusted scope, matching the precedence and
safety behavior established by orchestration_manifest and is_safe_cwd_manifest,
so writable parent directories cannot override the explicit home configuration.
| .\bin\code-intel.exe C:\path\to\repo | ||
| ``` | ||
|
|
||
| Remove `-SkipRepowise` when Repowise is installed and semantic memory is | ||
| desired. Optional providers remain in the default orchestration plan so a | ||
| configured machine gets the richer result without using a different product | ||
| path. | ||
| Use `--mode lite` or `--mode full` only when the default `normal` profile is | ||
| not appropriate. Optional providers remain in the orchestration plan and are | ||
| used when available. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Replace the stale -SkipRepowise guidance.
The table at Line [22] still says -SkipRepowise bypasses Repowise, while this updated section establishes --mode lite as the compiled CLI control. Replace the legacy flag or explicitly label it compatibility-only.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/public-beta.md` around lines 41 - 46, Update the options table near the
documented code-intel invocation to remove the stale -SkipRepowise guidance or
explicitly mark it as compatibility-only, and identify --mode lite as the
current compiled CLI control for bypassing Repowise. Keep the surrounding
normal, lite, and full mode behavior consistent with the updated usage section.
| $supported = @("Repo", "RepoPath", "Config", "Mode", "ValidateInstallation") | ||
| $unsupported = @($PSBoundParameters.Keys | Where-Object { $_ -notin $supported }) | ||
| if ($unsupported.Count -gt 0) { | ||
| [Console]::Error.WriteLine("Code Intel error: unsupported compatibility option: -$($unsupported[0])") | ||
| exit 64 | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Common parameters are rejected as "unsupported compatibility options".
With [CmdletBinding()], $PSBoundParameters includes -Verbose, -ErrorAction, -Debug, etc. when callers pass them, so invoke-code-intel.ps1 -RepoPath . -Verbose exits 64 instead of forwarding.
🐛 Proposed fix
$supported = @("Repo", "RepoPath", "Config", "Mode", "ValidateInstallation")
-$unsupported = @($PSBoundParameters.Keys | Where-Object { $_ -notin $supported })
+$ignored = @([System.Management.Automation.PSCmdlet]::CommonParameters)
+$unsupported = @($PSBoundParameters.Keys | Where-Object { $_ -notin $supported -and $_ -notin $ignored })📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| $supported = @("Repo", "RepoPath", "Config", "Mode", "ValidateInstallation") | |
| $unsupported = @($PSBoundParameters.Keys | Where-Object { $_ -notin $supported }) | |
| if ($unsupported.Count -gt 0) { | |
| [Console]::Error.WriteLine("Code Intel error: unsupported compatibility option: -$($unsupported[0])") | |
| exit 64 | |
| } | |
| $supported = @("Repo", "RepoPath", "Config", "Mode", "ValidateInstallation") | |
| $ignored = @([System.Management.Automation.PSCmdlet]::CommonParameters) | |
| $unsupported = @($PSBoundParameters.Keys | Where-Object { $_ -notin $supported -and $_ -notin $ignored }) | |
| if ($unsupported.Count -gt 0) { | |
| [Console]::Error.WriteLine("Code Intel error: unsupported compatibility option: -$($unsupported[0])") | |
| exit 64 | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@invoke-code-intel.ps1` around lines 33 - 38, Update the parameter validation
around $supported and $PSBoundParameters in invoke-code-intel.ps1 to exclude
PowerShell common parameters such as Verbose, ErrorAction, and Debug from
$unsupported, allowing them to pass through without exit code 64 while retaining
rejection of unknown compatibility options.
| if ([string]::IsNullOrWhiteSpace($RepoPath) -and -not [string]::IsNullOrWhiteSpace($Repo)) { | ||
| if ($null -eq $configData.PSObject.Properties["repos"]) { | ||
| [Console]::Error.WriteLine("Code Intel error: config is missing repos: $configPath") | ||
| exit 64 | ||
| } | ||
| Write-Host "Code intel invoke: installation validation passed; default route is the manifest-bound Rust DAG ($rustCli)" | ||
| exit 0 | ||
| } | ||
|
|
||
| $targetRepos = @() | ||
| if ($All) { | ||
| $configData = Get-Content -LiteralPath $Config -Raw | ConvertFrom-Json | ||
| $reposConfig = Get-JsonProperty $configData "repos" | ||
| if ($null -eq $reposConfig) { | ||
| throw "No repos configured in: $Config" | ||
| $entry = $configData.repos.PSObject.Properties[$Repo] | ||
| if ($null -eq $entry -or [string]::IsNullOrWhiteSpace([string]$entry.Value.path)) { | ||
| [Console]::Error.WriteLine("Code Intel error: repository alias has no configured path: $Repo") | ||
| exit 64 | ||
| } | ||
| $targetRepos = @($reposConfig.PSObject.Properties.Name) | ||
| } | ||
| elseif ($Repos.Count -gt 0) { | ||
| $targetRepos = @($Repos) | ||
| } | ||
| elseif (-not [string]::IsNullOrWhiteSpace($RepoPath)) { | ||
| $targetRepos = @([pscustomobject]@{ repo = ""; path = $RepoPath }) | ||
| } | ||
| elseif (-not [string]::IsNullOrWhiteSpace($Repo)) { | ||
| $targetRepos = @($Repo) | ||
| } | ||
| else { | ||
| throw "Specify -Repo <alias>, -RepoPath <path>, -Repos <alias[]> or -All." | ||
| $RepoPath = [string]$entry.Value.path | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
PowerShell Set-StrictMode Latest accessing non-existent property PSCustomObject PropertyNotFoundException
💡 Result:
When Set-StrictMode is enabled with -Version 2.0 or higher (including -Version Latest), PowerShell explicitly prohibits references to non-existent properties on objects [1][2][3]. If you attempt to access a property that does not exist on a PSCustomObject while this mode is active, PowerShell will throw a PropertyNotFoundException [4][3][5]. This behavior is by design [6]. Under normal conditions (with Set-StrictMode -Off), accessing a non-existent property on an object returns $null [1][7]. Enabling strict mode changes this to a terminating error to help catch potential bugs, such as typos in property names [5]. To handle cases where a property might not exist, you can use one of the following approaches: 1. Check for the property's existence before access: You can verify if the property exists in the object's PSObject members collection [4]: if ($myObject.PSObject.Properties['PropertyName']) { $value = $myObject.PropertyName } 2. Coerce the object or handle the result: Depending on the context, ensuring the object is of the expected type or structure (e.g., casting or wrapping in an array) can sometimes resolve issues where intrinsic members like.Count or.Length are expected [6]. 3. Use alternative conditional logic: Since PowerShell does not currently have a built-in null-conditional operator (like?. in other languages) for property access that suppresses this exception, explicit checks remain the standard way to avoid the PropertyNotFoundException when working in strict mode [4].
Citations:
- 1: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/set-strictmode?view=powershell-7.6
- 2: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/set-strictmode?view=powershell-7.5
- 3: https://renenyffenegger.ch/notes/Windows/PowerShell/command-inventory/noun/strictMode/set
- 4: Add an operator to allow safe checking for property names in Strict Mode PowerShell/PowerShell#15338
- 5: https://4sysops.com/archives/powershell-strict-mode-version-1-0-and-2-0/
- 6:
Set-StrictMode 2: False positive for references to theCountproperty PowerShell/PowerShell#16427 - 7: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/set-strictmode?view=powershell-7.4
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files:"
fd -a 'invoke-code-intel\.ps1$' . || true
file=$(fd 'invoke-code-intel\.ps1$' . | head -n1)
if [ -n "${file:-}" ]; then
echo "--- outline ---"
ast-grep outline "$file" --view compact || true
echo "--- relevant lines ---"
nl -ba "$file" | sed -n '1,120p'
fi
echo "--- searches ---"
rg -n "Set-StrictMode|PSObject\.Properties\[\"path\"\]|\\$entry\\.Value\\.path|entry.Value.path|IsNullOrWhiteSpace\\(\\[string\\]\\$entry" . || true
echo "--- behavioral probe (PowerShell strict-mode property access semantics) ---"
if command -v pwsh >/dev/null 2>&1; then
pwsh -NoProfile -NonInteractive -Command '
Set-StrictMode -Version Latest
$obj = [PSCustomObject]@{ repos = @{ api = [PSCustomObject]@{} } }
$entry = $obj.repos.PSObject.Properties["api"]
try {
if ($null -eq $entry -or [string]::IsNullOrWhiteSpace([string]$entry.Value.path)) {
"guarded-missing-reaches"
} else {
"guarded-missing-does-not-reach"
}
} catch {
"unhandled:" $_.Exception.GetType().FullName
}
'
else
echo "pwsh not available"
fiRepository: 2233admin/code-intel-pipeline
Length of output: 551
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Selected file:"
file=$(fd '^(invoke-code-intel)\.ps1$' . | head -n1)
echo "$file"
echo "--- outline ---"
ast-grep outline "$file" --view signatures || true
echo "--- first 120 lines ---"
awk '{ printf "%5d\t%s\n", NR, $0 }' "$file" | sed -n '1,120p'
echo "--- searches ---"
rg -n "Set-StrictMode|PSObject\.Properties\[\"path\"\]|\\$entry\\.Value\\.path|entry.Value.path|IsNullOrWhiteSpace\\(\\[string\\]\\$entry|repo.*path" "$file" . || true
echo "--- selected behavioral probe (PowerShell strict-mode property access semantics) ---"
if command -v pwsh >/dev/null 2>&1; then
pwsh -NoProfile -NonInteractive -Command '
Set-StrictMode -Version Latest
$obj = [PSCustomObject]@{ repos = @{ api = [PSCustomObject]@{} } }
$entry = $obj.repos.PSObject.Properties["api"]
try {
$value = $entry.Value.path
"unexpected-missing-succeeded: value=$value"
} catch {
"unhandled-missing:" $_.Exception.GetType().FullName
}
$obj2 = [PSCustomObject]@{ repos = @{ api = "" } }
$entry2 = $obj2.repos.PSObject.Properties["api"]
try {
$value2 = $entry2.Value.path
"unexpected-string-succeeded: value=$value2"
} catch {
"unhandled-string:" $_.Exception.GetType().FullName
}
$obj3 = [PSCustomObject]@{ repos = @{ api = @{ path = "" } } }
$entry3 = $obj3.repos.PSObject.Properties["api"]
$configuredPath = ""
$hasPath = $null
if ($null -ne $entry3 -and $entry3.Value -is [psobject]) {
$pathProperty = $entry3.Value.PSObject.Properties["path"]
if ($null -ne $pathProperty) { $configuredPath = [string]$pathProperty.Value; $hasPath = $true }
}
"missing-entry-false-ok: configuredPath=$configuredPath hasPath=$hasPath"
'
else
echo "pwsh not available"
fiRepository: 2233admin/code-intel-pipeline
Length of output: 4235
Check path before dereferencing it under strict mode.
With Set-StrictMode -Version Latest, entry.Value.path throws for a repos entry that is missing path or is not an object, before the intended "repository alias has no configured path" message plus exit 64 is reached. Guard the property lookup before assigning $RepoPath.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@invoke-code-intel.ps1` around lines 71 - 82, Update the repository alias
validation around $entry in the RepoPath resolution block to safely inspect
whether entry.Value has a path property before dereferencing it under strict
mode. Preserve the existing error message and exit 64 behavior for missing,
malformed, or blank paths, and assign $RepoPath only after the guarded
validation succeeds.
| "version": "1.0.0", | ||
| "toolchainDigests": [ | ||
| "cc37c3df902ba62b699f63545e46b5e73aa517ca3f412ff62f25da6ccc8b1cb0", | ||
| "fedeeb8350ae252209f8d8de1a62fbde9148811e7bde29723ea26aacf7ccacbb", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Recompute the declared digests for the doctor adapter inputs.
sha256sum crates/code-intel-cli/src/doctor_adapter.rs crates/code-intel-cli/src/capability_inventory.rs
# Check whether doctor declares a toolchainDigestEvidence input list.
python - <<'PY'
import json
m=json.load(open('orchestration/integrations.json'))
for i in m['integrations']:
if i.get('id')=='doctor':
print(json.dumps({k:v for k,v in i.items() if 'toolchain' in k.lower() or k=='capabilityDeclaration'}, indent=2))
PYRepository: 2233admin/code-intel-pipeline
Length of output: 797
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Locate relevant files"
git ls-files | rg '(^crates/code-intel-cli/src/(doctor_adapter|capability_inventory|capability)\.rs$|^orchestration/integrations\.json$)' || true
echo
echo "doctor adapter digest constants / hash function context"
if [ -f crates/code-intel-cli/src/doctor_adapter.rs ]; then
rg -n "registry_toolchain_digests_bind_the_adapter_and_dispatch_sources|toolchainDigest|capability_inventory|pipeline_root|discover_manifest|pub fn|const|Digest" crates/code-intel-cli/src/doctor_adapter.rs
fi
echo
echo "capability_inventory and capability references"
if [ -f crates/code-intel-cli/src/capability_inventory.rs ]; then
rg -n "pipeline_root|discover_manifest|registry_toolchain_digests|toolchainDigest" crates/code-intel-cli/src/capability_inventory.rs
fi
if [ -f crates/code-intel-cli/src/capability.rs ]; then
rg -n "pipeline_root|discover_manifest|capability::discover_manifest|registry_toolchain_digests|toolchainDigest" crates/code-intel-cli/src/capability.rs
fi
echo
echo "orchestration digest block"
python3 - <<'PY'
import json
from pathlib import Path
p=Path('orchestration/integrations.json')
m=json.loads(p.read_text())
for i in m['integrations']:
if i.get('id') == 'doctor':
obj = {k: v for k, v in i.items() if 'toolchain' in k.lower() or k == 'capabilityDeclaration'}
print(json.dumps(obj, indent=2))
PYRepository: 2233admin/code-intel-pipeline
Length of output: 950
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Digest provider implementation candidates"
rg -n "registry_toolchain_digests_bind_the_adapter_and_dispatch_sources|toolchainDigestEvidence|registry_toolchain_digests|capability::discover_manifest|pub fn discover_manifest|fn discover_manifest" crates/code-intel-cli/src crates || true
echo
echo "Read doctor_adapter.rs around registry_toolchain_digests constant"
python3 - <<'PY'
from pathlib import Path
p=Path('crates/code-intel-cli/src/doctor_adapter.rs')
lines=p.read_text().splitlines()
needle='registry_toolchain_digests_bind_the_adapter_and_dispatch_sources'
for idx,l in enumerate(lines,1):
if needle in l:
start=max(1,idx-40); end=min(len(lines),idx+80)
for n in range(start,end+1):
print(f"{n:5}: {lines[n-1]}")
break
elif True:
print("needle not found")
PYRepository: 2233admin/code-intel-pipeline
Length of output: 1660
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "doctor_adapter.rs digest test body"
sed -n '460,525p' crates/code-intel-cli/src/doctor_adapter.rs
echo
echo "capability discovery implementation"
sed -n '310,380p' crates/code-intel-cli/src/capability.rs
echo
echo "dependency/toolchain digest evidence parsing locations"
sed -n '700,755p' crates/code-intel-cli/src/native_code_evidence.rs
sed -n '370,410p' crates/code-intel-cli/src/project_orientation.rs
echo
echo "all digest claims in doctor integration"
python3 <<'PY'
import json
from pathlib import Path
m = json.loads(Path('orchestration/integrations.json').read_text())
for i in m['integrations']:
if i.get('id') == 'doctor':
cd = i.get('capabilityDeclaration', {}).get('implementation', {})
print(cd.get('toolchainDigests'))
evidence = i.get('capabilityDeclaration', {}).get('implementation', {}).get('toolchainDigestEvidence')
print('toolchainDigestEvidence:', evidence)
PY
echo
echo "check for declare_digest_or_find_digest function and digest mapping"
rg -n "declare_digest_or_find_digest|toolchainDigestEvidence|source_files|toolchainDigests" crates/code-intel-cli/src -SRepository: 2233admin/code-intel-pipeline
Length of output: 10426
Declare doctor toolchain digest evidence for the full digest input set
doctor has a second declared toolchain digest, but toolchainDigestEvidence is absent and the existing digest test only covers doctor_adapter.rs and capability_inventory.rs. Add the evidence/input mapping so manifest resolution changes captured at runtime are bound to declared digests.
[low Effort_and_high_reward]
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@orchestration/integrations.json` at line 288, Add the missing
toolchainDigestEvidence mapping for the second declared doctor toolchain digest
in the orchestration manifest, including the complete digest input set rather
than only doctor_adapter.rs and capability_inventory.rs. Reuse the existing
doctor evidence/input symbols and ensure all manifest resolution inputs captured
at runtime are associated with the declared digest.
| ## 仓库入口 | ||
|
|
||
| 这个仓库的根目录暂时保留 PowerShell 入口，只为兼容已发布包和团队脚本；它们处于退休路径，不接受新产品逻辑。新实现优先进入 Rust core，MoonBit 仅用于隔离验证。真正的治理边界见 [Repository Layout](docs/repository-layout.md)。 | ||
| 编译后的 `code-intel` 是唯一正式入口。PowerShell 只保留安装、恢复和旧命令转发，不实现 Pipeline 语义。真正的治理边界见 [Repository Layout](docs/repository-layout.md)。 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Align the PowerShell scope description with the listed adapters.
Line [43] says PowerShell only handles installation, recovery, and forwarding, but run-code-intel.ps1 is listed at Line [50] as a compatibility adapter host. Include adapters in the scope description or remove that entry.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 43, Update the PowerShell scope description in README.md
to include compatibility adapter hosting alongside installation, recovery, and
legacy command forwarding, keeping it consistent with the run-code-intel.ps1
entry in the listed adapters.
1 participant
What changed
code-intelcommand the primary operator entryWhy
The pipeline needs a stable compiled entry that remains useful across model updates while PowerShell stays a recovery-only redundancy path.
Validation
cargo test -p code-intel