Skip to content

chore: run repository review#4

Closed
ZeR020 wants to merge 1 commit into
mainfrom
coderabbit-audit
Closed

chore: run repository review#4
ZeR020 wants to merge 1 commit into
mainfrom
coderabbit-audit

Conversation

@ZeR020

@ZeR020 ZeR020 commented May 6, 2026

Copy link
Copy Markdown
Owner

Trivial PR to trigger a full CodeRabbit review of the codebase.

Summary by CodeRabbit

  • Chores
    • Minimal non-functional update applied to internal files. No changes to behavior, features, or user experience. This is an internal maintenance edit intended to keep repository metadata consistent; no action required from users.

Copilot AI review requested due to automatic review settings May 6, 2026 09:29
@ZeR020

ZeR020 commented May 6, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented May 6, 2026

Copy link
Copy Markdown
✅ Actions performed

Full review triggered.

@coderabbitai

coderabbitai Bot commented May 6, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 75773ff3-0c81-4c93-a79f-ad0fc7bc944b

📥 Commits

Reviewing files that changed from the base of the PR and between ff14a2b and 6c3fee1.

📒 Files selected for processing (1)
  • src/index.ts

📝 Walkthrough

Walkthrough

A single trailing comment line "// CodeRabbit audit trigger - trivial change" was added to src/index.ts after the formatMemoriesForCompaction function. No functional code or behavior was modified.

Changes

Comment Addition

Layer / File(s) Summary
Audit Trigger
src/index.ts (lines 619–620)
Inserted a trailing comment // CodeRabbit audit trigger - trivial change after formatMemoriesForCompaction; no behavioral impact.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~1 minute

Poem

A comment so small, a whisper so light,
Audits need triggers—this one's just right,
No code was harmed in this tiny affair,
Just words on a line, floating thin air. 🐰✨

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check ❓ Inconclusive The description is minimal but adequate for the PR's intent. However, it lacks completion of the template sections such as Type of Change, Checklist items, Testing, and Related Issues. Complete the template by marking the Type of Change (likely 'Refactoring' or a new category for 'Audit'), checking off applicable Checklist items, and adding brief Testing/Related Issues sections if applicable.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately reflects the main change: a minimal commit explicitly designed to trigger a CodeRabbit audit as stated in the description.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch coderabbit-audit

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Comment @coderabbitai help to get the list of available commands and usage tips.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Trivial PR intended to trigger a full CodeRabbit audit run.

Changes:

  • Adds a no-op comment at the end of src/index.ts to create a code diff.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/index.ts
Comment on lines +619 to +620

// CodeRabbit audit trigger - trivial change
@ZeR020

ZeR020 commented May 6, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai help

@coderabbitai

coderabbitai Bot commented May 6, 2026

Copy link
Copy Markdown

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai rate limit to show your current review rate limit status.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
  • @coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
  • @coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai generate unit tests to generate unit tests for this PR.
  • @coderabbitai resolve merge conflict to automatically resolve merge conflicts.
  • @coderabbitai autofix to automatically fix issues identified in unresolved review comments.
  • @coderabbitai resolve to resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit configuration file (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • You can also validate your configuration using the online YAML validator.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, support, documentation and community

  • Visit our status page to check the current availability of CodeRabbit.
  • Create a ticket on our support page for assistance with any issues or questions.
  • Visit our documentation site for detailed information on how to use CodeRabbit.
  • Join our Discord community to connect with other users and get help from the community.
  • Follow us on X/Twitter for updates and announcements.

@ZeR020

ZeR020 commented May 6, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai read all files in the src/ directory and services/ subdirectory, then provide a comprehensive code review covering: architecture, security vulnerabilities, TypeScript best practices, error handling, and performance optimizations. Include specific file:line references for any issues found.

@coderabbitai

coderabbitai Bot commented May 6, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Discover full directory structure
tree -a --noreport 2>/dev/null || find . -type f | sort

echo "---FILE LISTING---"
# List all files in src/ and services/
fd . src/ services/ --type f 2>/dev/null || find . -path ./node_modules -prune -o \( -path '*/src/*' -o -path '*/services/*' \) -type f -print

echo "---SRC FILES---"
fd . src/ --type f -e ts -e js -e json 2>/dev/null | sort | xargs -I{} sh -c 'echo "=== {} ==="; cat "{}"'

echo "---SERVICES FILES---"
fd . services/ --type f 2>/dev/null | sort | xargs -I{} sh -c 'echo "=== {} ==="; cat "{}"' 2>/dev/null || echo "No services/ directory found"

echo "---ROOT CONFIG FILES---"
for f in package.json tsconfig.json .env.example .env README.md; do
  if [ -f "$f" ]; then
    echo "=== $f ==="
    cat "$f"
  fi
done

echo "---ADDITIONAL CONFIG---"
fd . --max-depth 2 --type f -e yaml -e yml -e toml 2>/dev/null | xargs -I{} sh -c 'echo "=== {} ==="; cat "{}"'

Length of output: 270706


🏁 Script executed:

#!/bin/bash
for f in \
  src/services/privacy.ts \
  src/services/retrieval-context.ts \
  src/services/secret-resolver.ts \
  src/services/sqlite/connection-manager.ts \
  src/services/sqlite/shard-manager.ts \
  src/services/sqlite/sqlite-bootstrap.ts \
  src/services/sqlite/transcript-manager.ts \
  src/services/sqlite/types.ts \
  src/services/sqlite/vector-search.ts \
  src/services/tags.ts \
  src/services/transcript-capture.ts \
  src/services/user-memory-learning.ts \
  src/services/user-profile/profile-context.ts \
  src/services/user-profile/profile-utils.ts \
  src/services/user-profile/types.ts \
  src/services/user-profile/user-profile-manager.ts \
  src/services/user-prompt/user-prompt-manager.ts \
  src/services/vector-backends/backend-factory.ts \
  src/services/vector-backends/exact-scan-backend.ts \
  src/services/vector-backends/types.ts \
  src/services/vector-backends/usearch-backend.ts \
  src/services/web-server-worker.ts \
  src/services/web-server.ts \
  src/types/index.ts \
  package.json \
  tsconfig.json; do
  echo "=== $f ==="
  cat "$f"
  echo ""
done

Length of output: 139412


🏁 Script executed:

#!/bin/bash
set -e

files=(
  src/index.ts
  src/config.ts
  src/plugin.ts
  src/services/web-server.ts
  src/services/web-server-worker.ts
  src/services/api-handlers.ts
  src/services/vector-backends/backend-factory.ts
  src/services/vector-backends/exact-scan-backend.ts
  src/services/vector-backends/usearch-backend.ts
  src/services/sqlite/vector-search.ts
  src/services/sqlite/shard-manager.ts
  src/services/sqlite/connection-manager.ts
  src/services/sqlite/transcript-manager.ts
  src/services/ai/ai-provider-factory.ts
  src/services/ai/providers/openai-chat-completion.ts
  src/services/ai/providers/openai-responses.ts
  src/services/ai/providers/anthropic-messages.ts
  src/services/ai/providers/google-gemini.ts
  src/services/ai/opencode-provider.ts
  src/services/logger.ts
  src/services/tags.ts
  src/services/secret-resolver.ts
  src/services/memory-conflicts.ts
  src/services/deduplication-service.ts
  src/services/memory-scoring-service.ts
  src/services/memory-scoring.ts
  src/services/embedding.ts
  src/services/user-profile/user-profile-manager.ts
  src/services/user-prompt/user-prompt-manager.ts
  src/services/transcript-capture.ts
  src/types/index.ts
  src/services/ai/session/session-types.ts
)

for f in "${files[@]}"; do
  if [ -f "$f" ]; then
    echo "=== $f (numbered) ==="
    nl -ba "$f" | sed 's/\t/  /g'
    echo ""
  fi
done

Length of output: 3121


🏁 Script executed:

#!/bin/bash
set -e

num() { awk '{printf "%6d  %s\n", NR, $0}' "$1"; }

files=(
  src/config.ts
  src/index.ts
  src/services/sqlite/vector-search.ts
  src/services/ai/opencode-provider.ts
  src/services/logger.ts
  src/services/tags.ts
  src/services/embedding.ts
  src/services/web-server.ts
  src/services/api-handlers.ts
  src/services/deduplication-service.ts
  src/services/memory-conflicts.ts
  src/services/memory-lifecycle.ts
  src/services/ai/session/session-types.ts
  src/services/ai/ai-provider-factory.ts
  src/services/ai/providers/openai-chat-completion.ts
  src/services/ai/providers/openai-responses.ts
  src/services/ai/providers/anthropic-messages.ts
  src/services/ai/providers/google-gemini.ts
  src/types/index.ts
)

for f in "${files[@]}"; do
  if [ -f "$f" ]; then
    echo "=== $f (numbered) ==="
    num "$f"
    echo ""
  fi
done

Length of output: 264873


@ZeR020 Here is a comprehensive code review of src/ and src/services, focused on architecture, security, TypeScript practices, error handling, and performance. I’ve included concrete file:line references and actionable patches.

Architecture overview

  • Clear modular layering:
    • Plugin entry (src/index.ts) orchestrates config, background jobs, web UI, chat/event hooks.
    • Storage via SQLite shards (services/sqlite/*) with vector backends (USearch or exact-scan).
    • Retrieval/ranking (vector-search.ts) combines vector scores, tags, FTS, context, diversity.
    • Background services: scoring, lifecycle, deduplication, migration.
    • AI provider abstraction supporting OpenAI chat/responses, Anthropic, Gemini.
    • Web UI API (web-server.ts / web-server-worker.ts).
    • User profile learning and transcripts.
  • Strengths
    • Thoughtful shard metadata and migration pathways.
    • Retrieval blends relevance, recency, “strength,” and diversity to avoid redundancy.
    • Clean concurrency guards for auto-capture/profile learning.
    • Defensive JSON parsing helpers and stable logging.

High-severity issues and fixes

  1. Configuration gating is ineffective; isConfigured() always returns true
  • Problem: Many code paths guard critical behavior with isConfigured(), but config.ts returns true unconditionally, enabling features even when API keys/models are not configured.
    • src/config.ts Line 738–740: export function isConfigured(): boolean { return true; }
    • Used as guard in src/index.ts Lines 38–39, 43–50, 177–179, 511–513, 538–541.
  • Impact: Background jobs and handlers may run in partially configured states, leading to confusing runtime failures.
  • Fix (sample logic, adjust to your desired policy):
// src/config.ts
export function isConfigured(): boolean {
  const hasEmbedding = (CONFIG.embeddingApiUrl ? !!CONFIG.embeddingApiKey : true);
  const hasMemory =
    (!!CONFIG.opencodeProvider && !!CONFIG.opencodeModel) ||
    (!!CONFIG.memoryApiUrl && !!CONFIG.memoryModel && !!CONFIG.memoryApiKey);

  // Storage path is ensured on startup; treat that as OK
  return hasEmbedding && hasMemory;
}
  • Optional: In src/index.ts add a startup toast/log when not configured and disable features accordingly.
  1. Plugin SIGINT/SIGTERM handlers kill the host process
  • Problem: The plugin installs signal handlers that call process.exit(0/1).
    • src/index.ts Lines 158–171 (shutdownHandler + process.on).
  • Impact: In a host app, this can terminate the entire process when the plugin wants to shut down.
  • Fix: Perform cleanup but do not exit the process; and bind signals only once.
// src/index.ts (inside OpenCodeMemPlugin)
const shutdownHandler = async () => {
  try {
    stopScoringRecalculation();
    stopLifecycleJob();
    if (webServer) await webServer.stop();
    memoryClient.close();
    // Do not call process.exit(); let the host decide.
  } catch (error) {
    log("Shutdown error", { error: String(error) });
  }
};

// Avoid double-binding in multi-load scenarios
const GLOBAL_SIG_KEY = Symbol.for("opencode-mem0.signals.bound");
if (!(globalThis as any)[GLOBAL_SIG_KEY]) {
  process.on("SIGINT", shutdownHandler);
  process.on("SIGTERM", shutdownHandler);
  (globalThis as any)[GLOBAL_SIG_KEY] = true;
}
  1. Web server has no authentication/authorization
  • Problem: All endpoints are wide open; switching host to 0.0.0.0 (config default is 127.0.0.1 at src/config.ts Lines 168–171) exposes read/write memory/profile endpoints publicly.
    • src/services/web-server.ts Lines 191–416 (and web-server-worker.ts similarly).
  • Impact: Anyone on the network can list, add, update, and delete memories; delete prompts; run migrations and cleanup.
  • Fix: Add optional API key and Origin checks (backward compatible: if key unset and host is loopback, allow; otherwise require).
    • Config additions:
      • Add webServerApiKey?: string to OpenCodeMemConfig + DEFAULTS.
    • Minimal enforcement (pseudo-patch):
// src/services/web-server.ts (inside handleRequest, before routing)
const requiresAuth = CONFIG.webServerHost !== "127.0.0.1" && !!CONFIG.webServerEnabled;
const apiKey = req.headers.get("x-opencode-mem-key");
if (CONFIG.webServerApiKey && requiresAuth) {
  if (apiKey !== CONFIG.webServerApiKey) {
    return this.jsonResponse({ success: false, error: "Unauthorized" }, 401);
  }
}
// Optional: simple same-origin check for browsers
const origin = req.headers.get("origin");
if (requiresAuth && origin && !origin.startsWith(`http://${CONFIG.webServerHost}:${CONFIG.webServerPort}`)) {
  return this.jsonResponse({ success: false, error: "Forbidden" }, 403);
}
  • Mirror the same check in web-server-worker.ts.
  1. OAuth credential file written without secure permissions
  • Problem: opencode-provider writes auth.json updates without enforcing 0600 file mode.
    • src/services/ai/opencode-provider.ts Lines 116–121 (writeFileSync).
  • Impact: On POSIX systems, credentials could be readable by other users depending on umask.
  • Fix:
// After writeFileSync(...)
import { chmodSync } from "node:fs";
try { chmodSync(authPath, 0o600); } catch {}
  1. Provider type inconsistency prevents Gemini from being chosen in config
  • Problem: google-gemini is supported (ai-provider-factory.ts Lines 21–23; session-types.ts Line 1) but memoryProvider type in config excludes it.
    • src/config.ts Lines 56–57, 142–147.
  • Fix: Extend the union type and defaults.
// src/config.ts
memoryProvider?: "openai-chat" | "openai-responses" | "anthropic" | "google-gemini";
// In buildConfig() cast union accordingly
  1. Archived memories remain in vector indexes
  • Problem: archiveMemory() removes rows from memories but does not delete their vectors from the vector backend; indexes may retain stale entries, increasing memory and query cost.
    • src/services/memory-lifecycle.ts Lines 239–275 (archiveMemory), called from applyDecay() Lines 198–203.
  • Fix: Pass shard info to archiveMemory and call vectorSearch.deleteVector:
// src/services/memory-lifecycle.ts
function archiveMemory(db: any, memoryId: string, shard: ShardInfo): void {
// signature change; import ShardInfo & vectorSearch
// ...
  // Delete from memories (already present)
  db.run(`DELETE FROM memories WHERE id = ?`, memoryId);
  try { await vectorSearch.deleteVector(db, memoryId, shard); } catch {}
}

// Call with shard object in applyDecay():
archiveMemory(db, memory.id, shard);

Medium-severity and correctness
7) Similarity percentage may exceed 100%

  • Problem: formatSearchResults multiplies similarity by 100 without clamping.
    • src/index.ts Lines 598–602.
  • Fix:
similarity: Math.round(Math.max(0, Math.min(1, r.similarity)) * 100)
  1. listMemories may load 10,000 rows per shard
  • Problem: handleListMemories(tag) uses vectorSearch.listMemories(db, tag, 10000).
    • src/services/api-handlers.ts Lines 151–153.
  • Impact: Potential heavy I/O and memory for large shards.
  • Fix: Page at DB-level by created_at/strength and honor page/pageSize on the query (add OFFSET/LIMIT in vector-search.listMemories or add a paged variant).
  1. Engines claim Node support but runtime requires Bun
  • Problem: SQLite/HTTP stack relies on Bun (e.g., bun:sqlite, Bun.serve).
    • sqlite-bootstrap.ts uses require("bun:sqlite"); web-server.ts uses Bun.serve.
    • package.json engines includes node >= 20.
  • Fix: If Node isn’t a target, remove Node from engines. If Node is desired, add conditional adapters (e.g., better-sqlite3 and a small HTTP server abstraction).
  1. Session cleanup API unused
  • Observation: AIProviderFactory.cleanupExpiredSessions() exists but is never scheduled.
    • src/services/ai/ai-provider-factory.ts Lines 33–35.
  • Suggestion: Invoke on startup and periodically (e.g., hourly) alongside scoring/lifecycle jobs.

Security hardening (additional)

  • Restrict PII exposure from APIs if binding to 0.0.0.0:
    • api-handlers returns displayName, userEmail, projectPath, gitRepoUrl (e.g., Lines 111–121, 239–257, 550–568). Consider a “redacted” mode for remote hosts.
  • secret-resolver.ts: you only warn on permissive file perms (Lines 20–28). Optionally fail-fast when mode > 0600 in production mode.

TypeScript and API consistency

  • Timer vs NodeJS.Timeout types
    • src/index.ts uses Timer (Line 36). memory-lifecycle.ts uses Timer (Line 6), web-server.ts uses NodeJS.Timeout (Line 48).
    • Suggest unify on NodeJS.Timeout for consistency (Bun provides typings but a single type avoids confusion).
  • Widen config types to cover all actually supported providers (see #5).
  • Prefer specific types over any in selected surfaces (examples):
    • api-handlers timeline items (Lines 238–269) could use the defined interfaces FormattedPrompt | FormattedMemory everywhere to cut any.

Error handling and resilience

  • Most external calls are wrapped with try/catch and return uniform ApiResponse, which is good.
  • Consider structured errors for user-facing API (error codes plus messages), to distinguish auth (401/403), validation (400), and server errors (500).
  • In opencode-provider streaming transformer (Lines 203–227), the naive regex replacement may transform unrelated "name" fields in streamed JSON lines. Consider limiting to known event types or a minimal JSON parser for the tool blocks.

Performance notes

  • vector-search.rebuildFromShard() is called each search (Lines 128–146); USearchBackend caches and skips rebuild when initialized (usearch-backend.ts), which helps. Consider a background warmup at shard open to avoid per-request cold rebuilds and to reduce first-query latency.
  • scoring and lifecycle jobs operate over all shards with batched updates and transactions; good approach. You may consider throttling CPU load if you observe contention.

Minor polish

  • Console output in config bootstrap
    • src/config.ts Lines 23–26, 555–556 use console.log. Consider routing through logger (if initialized) or conditional on TTY/debug.
  • ExecSync usage in tags.ts (git lookups) is synchronous; acceptable on startup, but if you need this often, cache results.

Optional: small architectural diagram

flowchart LR
  A[OpenCode Host] -->|Plugin API| P[OpenCodeMemPlugin]
  P -->|Config & Logger| C[config.ts / logger.ts]
  P -->|Web UI API| W[web-server.ts]
  P -->|Embedding| E[embedding.ts]
  P -->|Memory Client| M[client.ts]
  M -->|Shards| S[(SQLite shards)]
  S <-->|Vectors| V[vector-backends (USearch|Exact)]
  P -->|Background Jobs| B[memory-scoring-service & memory-lifecycle]
  P -->|AI Providers| AI[OpenAI/Anthropic/Gemini]
  P -->|Profiles & Prompts| UP[user-profile/*, user-prompt/*]
Loading

Summary of suggested code edits (ready-to-apply excerpts)

  • Replace isConfigured() in src/config.ts (see #1).
  • Remove process.exit and bind signals once in src/index.ts (see #2).
  • Add optional API key + Origin checks to web-server.ts and web-server-worker.ts (see #3).
  • Enforce 0600 on auth.json writes in opencode-provider.ts (see #4).
  • Extend memoryProvider union in src/config.ts to include "google-gemini" (see #5).
  • Clamp similarity in formatSearchResults in src/index.ts (see #7).
  • Pass shard to archiveMemory and delete the vector from the backend in memory-lifecycle.ts (see #6).

Would you like me to:

  • Draft concrete diffs for these fixes as a follow-up plan, or
  • Open separate GitHub issues (one per area) summarizing impact and proposed changes?

@ZeR020 ZeR020 closed this May 6, 2026
@ZeR020
ZeR020 deleted the coderabbit-audit branch May 6, 2026 09:39
@ZeR020 ZeR020 changed the title chore: trigger CodeRabbit audit chore: run repository review May 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants