fix(release): address PR #102 review findings (member sync, bot refresh, workbench)#105
Merged
Merged
Conversation
…sh, workbench)
Backend:
- bots.rs refresh_bot_status: (1) check the INITIATE(prompt) gate up front and
return 403 instead of a false {ok:true} when create_message would silently skip
waking the bot; (2) require a DM with the bot so the private status_update_prompt
is never posted into a shared group channel (list_bots redacts it from non-managers).
- users.rs: length-guard bio (<=4000) and display_name (<=255) so PATCH /users/me
returns a clean 400 instead of a 500 / broadcasting an unbounded bio to every member.
Frontend:
- ProfileHovercard: an already-open card now reflects live member_updated frames
(derive from the members map, not the open-time snapshot).
- RendererHost: key the built-in LensPanel per path so a stale dirty flag from an
unsaved edit elsewhere can't permanently freeze a view-only lens's live-push.
- jsonFile (useFileEditor): re-check the dirty ref after fs.read resolves so a
live-push reload can't clobber a keystroke typed mid-read (conflict-recovery still forces).
- builtins (chart lens): step-aware fmtNum so large-magnitude ticks don't collapse to
duplicate labels; single-pass min/max instead of Math.min(...) spread (avoids RangeError).
Verified: cargo check clean, tsc clean, vitest 8/8, vite build clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the review findings on the #102 release (develop→main). Two came from the codex bot's inline comments; the rest from an adversarial multi-agent review of the release diff (each finding independently verified).
Backend
bots.rsrefresh_bot_status— (1) check theINITIATE(prompt)gate up front and return 403 instead of a false{ok:true}whencreate_messagewould silently skip waking the bot (codex docs(arch): add decentralized bot mesh design #1); (2) require a DM with the bot so the privatestatus_update_promptis never posted into a shared group channel —list_botsalready redacts that field from non-managers (merge-blocker, review docs(arch): add decentralized bot mesh design #1).users.rs— length-guardbio(≤4000) anddisplay_name(≤255): PATCH/users/menow returns a clean 400 instead of a 500 / broadcasting an unbounded bio to every channel member (review chore(deps): bump rand from 0.8.6 to 0.10.1 in /packages/agentnexus-acp-connector-rs #5).Frontend
ProfileHovercard— an already-open profile card now reflects livemember_updatedframes (derive from themembersmap, not the open-time snapshot) (codex chore(deps): bump tokio-tungstenite from 0.24.0 to 0.29.0 in /packages/agentnexus-acp-connector-rs #2).RendererHost— key the built-inLensPanelper path so a staledirtyflag from an unsaved edit elsewhere can't permanently freeze a view-only lens's live-push (e.g. the metrics chart) (review chore(deps): bump tokio-tungstenite from 0.24.0 to 0.29.0 in /packages/agentnexus-acp-connector-rs #2).jsonFile(useFileEditor) — re-check the dirty ref afterfs.readresolves so a live-push reload can't clobber a keystroke typed mid-read; conflict-recovery still force-reloads (review chore(deps): bump actions/checkout from 4 to 6 #3).builtins(chart lens) — step-awarefmtNumso large-magnitude ticks don't collapse to duplicate labels; single-pass min/max instead ofMath.min(...)spread (avoids a RangeError on very long series) (review chore(deps): bump docker/login-action from 3 to 4 #4/chore(deps): bump actions/setup-node from 4 to 6 #6).Verification
cargo checkclean ·tscclean ·vitest8/8 ·vite buildclean.🤖 Generated with Claude Code