[BunsDev]

Superseded by #366, which carries all reviewed CR2 work and the merged #354/#361 repairs onto current main while preserving the newly landed CF7 changes. The original evidence below remains historical; #366 records fresh integration validation. #321 remains open until the replacement lands and acceptance is audited.

Current integration status

The visibility-loss repair #354 and production Electron IPC acceptance test #361 are merged here, now at 8882aadbe70d54146f6edcc469d754849f43cfb8. Denial/not-found/identity failures invalidate retained PR data and concurrent sibling reads while preserving unrelated repositories and ordinary offline/rate-limit fallback.

#361 passed the required macOS unit/E2E check on c180c72187e9dbbeaa3df5815161774f3babb358 before merging. Its actual production preload/IPC/service test covers inbox → overview → files, distinct repository identities, foreign-account rejection and an unchanged checkout. Removing the production registration made it fail. Local build/typecheck and 1,955 unit checks passed (16 skips); the restored focused Electron test passed. Validate this resulting parent head and its main merge group before closing #321.

The original implementation and its SHA-specific evidence follow; their counts are not results for the current head.

CR-2 of tracker #319, for #321: main's read service on the code-review:read channel. It serves the contract #334 defined, and CR-3 (#346) binds its UI to it. Read-only. No checkout, no comment or review, no merge, no model call. Nothing is visible in the app until CR-3 lands.

How it reads

• Whose login: Val's own gh login ([CR-1][P1] Establish the Code Review reference contract and deterministic fixtures #320 decision 3). Modex adds no sign-in, and never sees, stores or asks for a token.

• The command: each read is gh api <fixed path> --hostname github.com --method GET --include, run through execFile with no shell.

• What gh.ts refuses:

  • any path that isn't user, the issue search, or under repos/;
  • any flag, host, space, {owner} placeholder or dot segment;
  • GH_DEBUG, which is never forwarded.

  Nothing gh prints to stderr is kept.

• The channel: handle("code-review:read", …, { localOnly: true }) in index.ts, so paired desktops can't reach it. The payload is untrusted until validateRequest has rebuilt it. Browser development and the Store demo answer the channel without GitHub.

The design page's new Read service section holds the details: principal and scopes, how each gh failure maps to a reason, keys and generations, revisions, limits and memory, and refresh.

What's in it

Commit	What
372edbf	The BridgeCommands line, "code-review:read": { req: CodeReviewRequest; res: CodeReviewReply | null }. cancel answers null.
a34ef72	Contract changes for what GitHub actually returns (below).
ae6ea30	The Store demo answers the channel as unavailable. Its handler map has to cover every channel.
197276e, f2c2de7, d31f661	The service, then the fixes from the review and the re-review: src/main/engine/code-review/{gh,github,read-service}.ts, the handlers, three test files, the design page and status.md.

CR-3 (#346) carries the first three commits as cherry-picks.

Contract changes:

• stackHint becomes boolean | null, because search results name no base branch.
• Unavailable gains head-changed.
• parseRevision is exported.

Acceptance, criterion by criterion

The fixture evidence comes from a synthetic GitHub: two accounts, and two repositories that both have a #73. The authenticated evidence is separate, under AC5.

• AC1: list → detail → files through main's handler, with no local mutation.

  • code-review-ipc.test.ts slices handle("code-review:read", …) out of compiled index.js and checks it is registered localOnly. It drives that handler closure, the real service and the real gh transport against a fake gh executable: connection, inbox, overview of both #73s, then files.
  • The test does not go through Electron's ipcMain. The shared handle() wrapper (trusted sender and document epoch) is covered by the existing main tests.
  • Every endpoint called is on the allowlist, and nothing is written except the fake's own log.
  • A scan of the read path's sources finds no fs or git.ts import, no write call, no -X, graphql or write method, and no Discard.

• AC2: identical numbers and account switches.

  • Two #73s whose answers arrive in the opposite order to the requests each answer only their own request, and acceptsReply rejects each for the other.
  • Main fingerprints gh's hosts.yml, which gh auth switch, login and logout rewrite.
    • It rechecks the account when the fingerprint changes, and confirms the account after every read before replying or keeping anything.
    • A read whose fingerprint moved while it ran is refused, even if gh is back on the same account.
    • Where the file can't be read, it confirms with a conditional gh api user (a free 304). A check that fails, fails the read.
    • A switch that leaves the file alone is caught when the 30 s TTL runs out.
  • A switch during a slow read, with no connection read in between, answers signed-out with nothing in it. This holds whether the read was aborted or gh finished it as the new account.
  • A key for the old account is refused without making a request. The read that noticed the switch answers under the new account.
  • After a switch, everything learned under the old account is gone, including its rate-limit state.

• AC3: recoverable states, with no secret leakage.

  Case	Result
  401 (revoked)	signed-out, and the identity is dropped
  404	not-found
  403	denied
  403 with SSO	denied, with a message to authorize gh for single sign-on
  Malformed or non-github.com link	invalid, with no request made
  Timeout	timeout
  Primary rate limit	rate-limited with retryAfter; main makes no request until the reset
  Secondary limit (429 with Retry-After)	rate-limited
  Search past GitHub's own time limit	partial, reason timeout
  Search past 1,000 results	capped; p35 and foreign cursors are refused
  Files past 3,000	capped
  Patch missing with no changed lines	binary (covered)
  Patch missing with changed lines	too-large (missing)
  Offline refresh	stale, with the last good answer

  Fake gh stderr and bodies carrying ghp_… strings never reach a reply.

• AC4: head changes.

  • If the head moved before a files page, the page is stale with the last good copy, or unavailable: head-changed when there is none.
  • If it moved during the page, the page is stale: head-changed.
  • Checks for an old head are stale, so summarizeChecks calls them incomplete.
  • context refuses a revision the PR never had, without making a request.
  • A name that now belongs to a different repository answers not-found.

• AC5: authenticated read-only smoke test. Recorded separately below.

• AC6: no regressions, no broad permissions, no write endpoint, no cloud service.

  • The full suite passes; numbers are under Evidence.
  • The only new process is gh api … --method GET.

AC5: authenticated smoke test (TypeSafeAI/modex, authorized by Val on 2026-10-20)

apps/desktop/.probes/cr2-live-smoke.mjs is git-ignored. It runs the compiled service with the real transport through Val's gh login and prints no token, header value or response body.

Account	BunsDev (id 68980965) on github.com, gh 2.98.0, API version 2022-11-28
Repository	TypeSafeAI/modex, stable id 1386876170
PR #334	head 5106c0d8e56d4ea3f72d37c1b1afe45f9d30a57e, base main at e2d7703a63e76d08373fb165b50c010510b56017, merged; 2026-10-20T19:59:15Z
PR #330	head 6f3a6c98c7cdaaacee25570c12a0c303ff4c8b0d, which includes a real bot review

Results, the same on both PRs:

• Ready: connection, inbox, resolve, overview, activity, checks, files and context. On Define the Code Review read contract and fixtures (CR-1) #334: checks 13 of 13, files 5 of 5, and 33 activity items.
• Refused, as designed: stack (waiting for [CR-4][P1] Reconstruct PR overview, activity, checks, stack and preview cards #323), a key for another account (signed-out), and an unknown repository id (not-found).
• Requests: after the review fixes, each run made 17: 15 core and 2 search. 7 of them were free 304s. Only one was gh api user, because the unchanged hosts.yml fingerprint confirms the account after every other read. Full results are in docs/reviews/2026-10-20-cr2-read-smoke.md.

The first live run found two mapping gaps, both fixed here with failing tests first:

• Cross-references have no id of their own.
• The timeline spells review states in lower case.

After the fix, real timelines for #295, #316, #330 and #334 map with nothing dropped.

Also checked live, and written into the design page:

• Search results carry repository_url but no repository object, though the schema lists one.
• A 304 exits 1 but still prints its status line, and isn't charged.
• Under the raw media type, a directory comes back as JSON.

Evidence

• Red first:

  • Each new test file failed to compile before its module existed (Cannot find module …/gh.js, then …/read-service.js).
  • The cross-reference case and the lowercase-review case each failed before their fixes.

• Code Review tests: 48 pass across the four files: the contract test plus the three new ones.

• Mutation checks: I broke the compiled read path and the contract 44 ways, one at a time, and every break failed a test. That includes 19 aimed at the review and re-review fixes. Among them:

  • an old-account reply let through;
  • caches kept across a switch;
  • no head check before or after a files page;
  • checks on an old head counted as current;
  • rate limits not held;
  • the search cap not reported;
  • context served for any revision, or a directory served as a file;
  • a reborn repository accepted;
  • identity never rechecked;
  • no concurrency bound;
  • no conditional requests;
  • a 401 that keeps the identity;
  • SSO read as plain denied;
  • duplicate request ids;
  • the stack hint never learned;
  • no stale fallback, or a stale answer for a cancelled read;
  • binary and too-large swapped;
  • pending reviews listed;
  • GH_DEBUG forwarded;
  • another host allowed;
  • offline read as failed.

• Full suite: pnpm build && pnpm test exited 0 on d31f661 (base 43d5b9c, macOS, Node 24.18.1):

  • worktree scripts: 111/111;
  • core: 16/16;
  • desktop unit: 1,753 passed, 16 skipped, 0 failed;
  • then 21, 10 and 16 in the remaining suites.

  A trial merge with current main (ac7f743) is clean, and the merge queue tests the combination.

• E2E: not run locally. There is no renderer change, and free disk was low (2.4 to 7.5 GB). CI's unit + e2e (macOS) runs it.

Review

An independent review of 197276e requested changes: one AC2 blocker, five should-fix and a dozen nits. All of them are fixed in f2c2de7, each with a failing test first.

A re-review of f2c2de7 found two more AC2 holes in the new after-read check, plus a partial fix for item 5. They are fixed in d31f661. Both replies are in the PR comments.

Not done here

• stack waits for [CR-4][P1] Reconstruct PR overview, activity, checks, stack and preview cards #323's choice of source.
• activity: a commit's author is a git identity, so author is null. deployed events are plain events until [CR-4][P1] Reconstruct PR overview, activity, checks, stack and preview cards #323 decides how deployments are read.
• Reviewers: requested teams aren't listed.
• Open for Val: whether the Code Review destination shows before Gate A completes. CR-3 hides it in built apps behind a single switch.

Coven-Harness: Claude Code / claude-opus-5-5

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
modex	Ready	Preview	Oct 21, 2026 2:47am UTC

[BunsDev]

Independent review of 197276e: findings and fixes

An independent reviewer requested changes. It worked read-only against fake transports, and its probes were scratch scripts outside the repository. I confirmed each finding, wrote a failing test first, then fixed it. The changes are in f2c2de7.

#	Finding	Severity / AC	Fix
1	A gh auth switch inside the 30 s identity window went unnoticed. Reads ran as the new account but were stamped as the old one.	Blocker, AC2	Main fingerprints gh's hosts.yml, which switch, login and logout rewrite. It rechecks the account when the fingerprint changes, and confirms the account after every read before replying. Where the file can't be read, it confirms with a conditional gh api user (a free 304). New tests cover a switch with no connection read in between, and the no-hosts-file fallback.
2	Once the identity TTL had passed, an offline, slow or rate-limited refresh dropped the kept answer. The inbox replied with a null account.	AC3	When the identity check itself fails transiently, main answers from the last confirmed account: kept answers come back stale under that account's scope.
3	group() left rejected repository lookups unhandled.	AC3	Promise.allSettled, then the first real failure is raised. The test listens for unhandledRejection and gets none.
4	A 2xx that gh printed and then exited non-zero was served as a complete file.	AC3	That case is now failed. A 304, and a 4xx gh printed in full, are unaffected.
5	Coverage said complete when rows were missing.	AC3	A files page that stops short of the PR's count is partial. Search pages after the first never claim complete; the renderer dedupes by key against total.
6	Checks weren't re-read against the head afterwards.	AC4	Checks are now bracketed by PR reads, like files.

Nits, all fixed with tests:

• Enum lookups use Object.hasOwn, so constructor and __proto__ map to unknown, and the reply can cross IPC.
• Timestamps must be ISO 8601.
• A 429 without Retry-After holds requests for 60 s.
• A change of login, or a switch of account, clears rate-limit state.
• A recreated repository is re-resolved.
• The read that notices a switch is no longer aborted.
• Duplicate request ids are rejected.
• activity's loaded counts the provider's own items.
• A read cancelled while waiting for a slot never starts gh.
• A forced identity check never joins one that started before it.
• Malformed search rows read as failed, not denied.
• A check list that stops short of its total, without hitting main's page limit, is failed, not capped.

Also from the review:

• AC1 wording: the test drives main's compiled handler closure and checks it is registered localOnly. The shared sender check in handle() is covered by the existing main tests. The PR body now says that.
• AC5 reproducibility: the smoke probe and its results are committed as docs/reviews/2026-10-20-cr2-read-smoke.md.

Coven-Harness: Claude Code / claude-opus-5-5

[BunsDev]

Re-review of f2c2de7: findings and fixes

The re-review confirmed the six original findings fixed (5 only partly) and found two new AC2 holes in the after-read check. Each fix below started with a failing test; the changes are in d31f661.

#	Finding	Fix
A	A switch away and back within one read was accepted: gh answered the original account again.	Each read records the hosts.yml fingerprint it began under. If the fingerprint moved during the read, the answer is refused (failed, "sign-in changed") and nothing is kept, even when the account matches now.
B	A confirming check that failed passed the read.	A failed check now fails the read, with the check's own reason. Without a hosts file to watch, a failing read under an unnoticed switch can't fall back to the old account's kept answer either.
—	The inbox kept its groups before the check.	Groups are kept only after the check.
C	After a seen login change, an offline read showed the last account's kept answers.	No fallback once the fingerprint shows the login changed.
5 (partial)	Nothing in CR-2 deduplicated inbox pages.	The contract's mergePages joins a group's pages, deduplicated by key. The list is complete only when every page was read in full and the distinct rows reach total. The test reproduces the review's case: #129 repeated, #130 skipped.
nit	Same-size rewrite within one timestamp tick.	The fingerprint includes the file's change time.

Two things are left as they are, and the design page records both:

• The blocking statSync: it reads one small local file. I kept it synchronous.
• The limit without a hosts file: a switch away and back within one read can't be seen.

Mutation checks: 44, six of them aimed at these fixes. Every break fails a test.

Coven-Harness: Claude Code / claude-opus-5-5

[BunsDev]

Re-review of d31f661: approved

The independent reviewer approved this commit. It confirmed AC2, AC3 and AC4 against the earlier findings and some new probes, run with and without a readable hosts.yml.

Fixed, and confirmed:

• A: a switch away and back within one read. Fixed wherever hosts.yml can be read, or doesn't exist. An unreadable file is the documented exception.
• B: a failed confirming check. Fixed in both modes.
• Kept answers: written only after confirm().
• C: a switch followed by offline.

Open, none blocking:

1. mergePages: a PR closing between pages can balance a skipped row, so the list reads complete. The fix is to also require every page to report the same total. Nothing calls it yet; CR-3 fixes this before relying on it (noted on [CR-3][P1] Build the PR inbox and resizable Code Review workspace #322).
2. Only when hosts.yml can't be read: offline within the 30 s window answers unavailable, but after it stale.
3. Hardening, unconfirmed:
   • keep() doesn't recheck the generation after confirm().
   • Kept inbox and resolve answers aren't keyed by account; clearing them on a switch is what keeps accounts apart.
4. By design, documented in the design page:
   • the synchronous statSync;
   • an unreadable hosts.yml can't catch a switch away and back.

The reviewer also advised that the renderer retry a "sign-in changed" refusal at most once.

Coven-Harness: Claude Code / claude-opus-5-5

[github-code-quality]

Code coverage overview

Languages: TypeScript

TypeScript / code-coverage-agent

main 4e9d965	cr2-read-service 2ba1462	+/-
64%	65%	+1%

View coverage of the 7 most impacted files.

File	main 4e9d965	cr2-read-service 2ba1462	+/-
apps/store-desk...rc/main/demo.ts	95%	95%	0%
apps/desktop/sr...shared/types.ts	100%	100%	0%
apps/desktop/sr...ain/commands.ts	86%	87%	+1%
apps/desktop/sr.../code-review.ts	99%	100%	+1%
apps/desktop/sr...read-service.ts	0%	98%	+98%
apps/desktop/sr...eview/github.ts	0%	99%	+99%
apps/desktop/sr...de-review/gh.ts	0%	100%	+100%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 21, 2026 01:28 UTC}