Exact

Exact Union RegExp

Shaojin Wen 5715782279 feat(review): post --comment reviews to Aone Code via the a1 CLI (#9491) ... * feat(review): post --comment reviews to Aone Code via the a1 CLI The Aone chain of /review was read-only: a review of an Aone MR ran fully but `--comment` refused. This lands the Phase 3 submit slice — an authorised run now posts through `a1`: one comment per inline finding, then the summary comment, and `a1 repo mr approve` on an APPROVE. Aone has no native request-changes state, so that verdict posts a blocking summary header and leans on the discussion merge gate; the terminal names the difference. Writes ride a no-retry transport (a transient retry after an accepted write would double-post). The commit_id gate GitHub enforces server-side lives in the provider as a pre-write head-drift refusal, and a mid-batch failure reports exactly what landed with exit-3 do-not-re-run advice instead of a retryable throw. The recorded-but-hostless refusal stays fail-closed, now between two writable platforms. * fix(review): count an accepted-but-unreadable Aone answer as posted The triage review of #9491 flagged the gap: if `a1` ACCEPTED a comment but answered unparseable JSON, the read-back threw before the post was counted — the partial-post report undercounted by exactly that comment, and if it was the first, the do-not-re-run advisory did not fire at all, so a retry would double-post it. Split the read-back semantics: an exec failure still propagates (the write genuinely failed), but a succeeded exec whose answer fails to parse now degrades to "landed, result unreadable" — counted as posted, only the id dropped. The fail-open empty-sourceBranch drift gate is left as the deliberate, tested trade-off it was reviewed as; it is now named in the Phase 3 design-doc note beside the Q4 follow-ups. * docs(review): record the Aone write-path trade-offs in the Phase 3 note Names the two deliberate trade-offs the triage review of #9491 flagged for the Q4 era: the head-drift gate is fail-open on an empty sourceBranch, and the created-comment id read-back is best-effort — plus the tolerant read-back semantics the follow-up fix introduced. * fix(review): close five write-safety holes in the Aone submit path The maintainer review of #9491 found five ways the new Aone write path could post to the WRONG platform or double-post; all five closed: 1. The target-platform-unbound refusal never read the --host flag it names as the remedy, so the --user-authorized re-run refused again forever. An explicit flag on the re-run is platform proof and now lifts the refusal. 2. The write gate compared hosts with raw equality, but Aone is one platform under two names (the CR URL records the web host, the skill's --host rule carries the git host). Hosts now bind through hostsEquivalent, like every other host comparison in remote-match. 3. Platform routing keyed on the family wildcard and the ambient GH_HOST, so a ghe.alibaba-inc.com GHE export selected a1, and a recorded Aone host outranked an explicit --host github.com (the opposite of the registry's documented precedence). Write routing now keys on the canonical Aone pair (isAoneCanonicalHost), never consults the ambient GH_HOST (reads never detect from it), and lets an explicit --host outrank the recorded binding in both directions. 4. a1 takes a comment body as one argv element; Linux caps that at 131072 bytes while compose-review's cap counts characters, so a long bilingual CJK summary died with E2BIG only after every inline had landed. A size gate now refuses the whole batch before any write. 5. An accepted-then-died write (timeout after the POST committed, a reset mid-response) read back as not-landed, suppressing the do-not-re-run advisory and inviting the double-post a1Once exists to prevent. Exec failures now count as possibly-landed (ambiguous), so the advisory fires even when the count is zero. * fix(review): harden the Aone submit path per the verify-lane review The sandboxed-verification review of #9491 (8 Critical, 24 Suggestion) caught the next layer of the write path; every finding addressed: Platform selection: - The unbound refusal now also fires when NO recording exists at all: a --user-authorized publish from another directory finds nothing, and the cwd probe alone must not pick the platform of an irreversible write. Tests that modeled the old cwd-fallback now model evidence: args() seeds a recording, session-scoped recordings are seeded where a session id is set. - The gh write rebinds its routing host to the evidence that selected it (explicitHost ?? recordedHost) — a recorded GHE host no longer posts wherever the ambient env pointed. - Host comparison is normalised ONCE (case/port/trailing-dot) and shared by hostsEquivalent and isAoneCanonicalHost, so the write gate and the router cannot normalise differently; a port-bearing CR-URL host no longer dies at the gate after the whole review ran. - The fast-path repo axis binds case-insensitively (GitHub resolves owner/repo case-insensitively server-side). - The cross-session recording scan is last-writer-wins by mtime; the NEWEST same-PR recording decides (its host, or unbound) instead of an older session's stale host masking the newest recording's hostlessness. - recordedSeverityFloor binds through hostsEquivalent too — the floor recovery no longer silently discards the operator's floor on the web-host/git-host alias. Reporting: - a1Cause reads the captured stderr, not the execFileSync message: the message embeds the full argv — the entire multi-line comment body — so parsing it surfaced the operator's own review text, never a1's error. - The REQUEST_CHANGES terminal note is conditioned on the inline Criticals actually posted — a body-only Critical posts no discussion threads, so nothing mechanically blocks the merge and the note says so. - The summary skip-guard keys on the posted summaryMessage, not the raw body: an empty-body REQUEST_CHANGES still posts its blocking header, the verdict's sole carrier on Aone; the size gate measures the same message. SKILL.md: the mid-batch bullet no longer commands hand-posting the remainder (it contradicted the write-monopoly rule); it names the oversized-comment refusal as the third Aone-specific shape; the relay-the-link fallback stops assembling Aone links from meta's collapsed owner/repo (a nested-group hazard) and relays the target's coordinates. Tests: 24 mutation-driven hardening cells (ordering via invocationCallOrder, exact argv pins, boundary cells at 131071/131072, RC-header accounting, stderr-over-message, summary-create failure, accepted-then-unreadable counts, attribution-off passthrough, url-absence arm, positive read-retry). 3861 review tests green. * test(review): pin hostsEquivalent's alias equivalence across spelling variants * fix(review): close the third-layer holes in the Aone submit path The third review round of #9491 found the layer under the last one; every finding addressed: Platform selection: - The cwd arm of the write gate probes the origin through the CANONICAL predicate itself instead of delegating to the registry's family-wildcard detection: a ghe.alibaba-inc.com origin no longer takes the a1 path. - submit FORCES context-unavailable into the compose input on the Aone path: the cap no longer rides the model-written state, so an omitted contextUnavailable cannot compose an APPROVE that the a1 path turns into a real platform approval. The docs now say the native approve does not fire this phase. - The floor recovery's host axis binds to the host the write routes at (explicit ?? recorded ?? gh fallback): a flagless Aone post no longer drops the operator's recorded severity floor. Failure shapes: - A mid-batch failure emits "partial": true with the landed counts and comment ids: posted:false alone invited a wrapper retry that double-posts what landed. The summary's fate is stated when it was the write that died. - A deliberate pre-write refusal (drift, oversized) reads as aone-post-refused; an UNEXPECTED pre-write error rethrows, gh-parity — nothing landed, a re-run is safe, a recoverable blip no longer loses the authorised review. - The batch re-reads the head once after posting and discloses a mid-batch amend (headMovedDuringPost) instead of claiming the pins held. Text: - The approve-failure WARNING and the oversized refusal name the USER as the manual actor — "by hand" is never an agent action, and Step 7's ban now says so. - SKILL.md: restored the exact subcommand enumeration, qualified the cleanup tripwire as GitHub-only, taught the completion contract the partial/approved shapes, and documented the repeat-round caveats (no dedup backing yet, no self-PR detection on Aone). Tests: cwd canonical-arm cells (GHE family origin falls to gh), the forced-cap wiring, structured partial JSON, refusal-vs-failure reasons, the rethrow cell, missing-sourceBranch key, mid-batch drift disclosure, and the a1JsonOnce transient-no-retry invariant. 3870 review tests green. * fix(review): close the residual holes the sandboxed verify report found The follow-up-2 sandboxed verification of #9491 (155 scripted assertions, 153 pass / 2 fail) re-measured everything at the new head and surfaced three findings; all three closed: - F1R: a failed write exiting with EMPTY stderr (the 120 s deadline kill, SIGKILL/OOM, an a1 crash before writing) made a1Cause fall back to parsing the exec message — and Node embeds the FULL argv in it, so the "cause" quoted a line of the operator's own review body. The fallback now reports exit facts only ("a1 failed without stderr (exit N) / (signal X)"), never the argv-bearing message. The dominant shape (real a1 error on stderr) is untouched. - F3: the forced context-unavailable wiring on the Aone path survived 3870 tests unpinned — submit's compose now has a cell asserting the compose input carries contextUnavailable: true on the Aone path and false on the gh path. - F2: createdCommentId's result/data nestings were correct but unpinned (a key-drop mutation survived). A new cell pins ids read back from {result:{id}} and {data:{id}}. * fix(review): close the round-5 platform-binding holes in the Aone write path - Order the cross-session recorded-args scan by each recording FILE's mtime (writeSkillArgs rewrites in place, so the directory mtime never advances); fold the publishing session's own recording and the sessionless root recording into the same newest-wins ordering instead of pinning them ahead of (or behind) the sorted siblings. - Refuse an explicit --host that contradicts the recorded host (target-platform-conflict): the flag fills a gap in the recorded evidence, it does not retarget the recorded review at another platform's same-named repo. The Aone web/git alias still passes through hostsEquivalent. - Fail closed on a hostless recording read via the --skill-args override: the submission cwd's origin probe names submit's clone, not the review's, and must not stand in for the missing platform evidence; the --host remedy lifts the refusal. - Bind the gh routing host to the cwd origin when the cwd arm selected the platform (and mirror the chain in the floor recovery's host axis), so a cwd-selected post no longer restores ambient env inheritance and routes past the clone that chose the platform. - Hand the GitHub path's contextUnavailable claim through raw so compose-review's deliberate shape check still refuses a malformed non-boolean instead of silently coercing the cap away. - Serialize the partial-post ambiguous flag in the stdout JSON and give the partial shape its own completion-line disposition in the skill — never the `not posted` form a retry-on-not-posted wrapper acts on.		2026-08-20 16:27:16 +00:00
..
assets	feat: support workspace display names (#7179)	2026-07-20 15:16:44 +00:00
design	feat(review): post --comment reviews to Aone Code via the a1 CLI (#9491)	2026-08-20 16:27:16 +00:00
developers	fix(sdk): route unrecognized diagnostics onto a bounded transcript sidechannel (#9202)	2026-08-19 14:38:00 +00:00
e2e-tests	feat(worktree): Phase D — startup --worktree flag + symlinkDirectories + PR refs (#4381)	2026-05-27 17:04:51 +08:00
images	fix(web-shell): render built-in tag icons (#7024)	2026-07-17 15:33:34 +00:00
plans	fix(serve): Harden standalone conversation primitives (#9512)	2026-08-20 08:09:44 +00:00
superpowers	feat(cli): reference prior sessions via @ and add completion tabs (#7302)	2026-07-24 06:11:48 +00:00
users	feat(review): post --comment reviews to Aone Code via the a1 CLI (#9491)	2026-08-20 16:27:16 +00:00
verification/abort-controller-refactor	fix(core): stop AbortSignal listener leak in long sessions (MaxListenersExceededWarning) (#4366)	2026-05-26 14:21:49 +08:00
_meta.ts	feat: refactor docs	2025-12-05 10:51:57 +08:00
index.md	fix: lint issues	2025-12-19 15:52:11 +08:00