Conversation
…cy checks in the pipeline
…, enhance file handling in adapters, and improve privacy checks in the pipeline
Extract CLI inspection and hook management into focused modules, move core doctor reporting behind pipeline/doctor.rs, and isolate watcher service registration. Split adapter hook handling and SDK frontmatter helpers while preserving the existing public APIs and behavior.
Quality improvement
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5fb06d3. Configure here.
|
|
||
| const MAX_ENTITY_TREE_DEPTH: usize = 32; | ||
| const MAX_ENTITY_FILE_COUNT: usize = 1024; | ||
| const MAX_ENTITY_TOTAL_BYTES: u64 = 64 * 1024 * 1024; |
There was a problem hiding this comment.
Entity limit constants duplicated across two crates
Medium Severity
MAX_ENTITY_TREE_DEPTH, MAX_ENTITY_FILE_COUNT, and MAX_ENTITY_TOTAL_BYTES are defined with identical values in both agentmesh-adapter-sdk-rust and agentmesh-core::pipeline. These represent the same security limits for the same kind of operation (entity file collection). If one is updated without the other, adapters and the pipeline would enforce inconsistent limits, potentially causing sync failures for entities that pass adapter import but are rejected by the pipeline (or vice versa).
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5fb06d3. Configure here.
|
|
||
| fn relative_or_path(workspace_root: &Path, path: &Path) -> PathBuf { | ||
| workspace_relative(workspace_root, path).unwrap_or_else(|_| path.to_path_buf()) | ||
| } |
There was a problem hiding this comment.
Identical helper function duplicated across both adapters
Low Severity
The relative_or_path function is identically defined in both the Claude and Codex adapters. This new utility (a fallback wrapper around the SDK's workspace_relative) was introduced in this diff in both places simultaneously. It belongs in the adapter SDK alongside workspace_relative, where both adapters already import their shared helpers from.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5fb06d3. Configure here.
1 participant
Note
Medium Risk
Symlink rejection and scan limits change import/sync behavior on unusual trees; privacy heuristics may produce noisy doctor warnings without changing sync data.
Overview
Bumps the workspace to 0.1.2 and tightens how AgentMesh reads repos and talks to adapters, alongside several module extractions and CI tweaks.
Safety and dependencies: Entity import/sync and shared
collect_entity_filesnow avoid following symlinks and enforce depth, file-count, and byte limits. Adapter JSON-RPC reads reject oversizedContent-Lengthvalues before allocating the body.jsonschemais built withdefault-features = false, which removes a large HTTP/TLS dependency tree from the lockfile.Doctor: Health reporting moves into
pipeline/doctor.rsand gains lockfile privacy warnings when entity IDs, paths, lineage, or override keys look credential-like, with a newlockfile_privacy_warningscount onDoctorHealth.Refactors: Runtime hook install/remove logic is split into
hooks.rsfor Claude, Codex, the CLI, and the watcher’s OS service registration; frontmatter handling moves into the adapter SDK’sfrontmatter.rs..gitignoreadds.ai/andagentmesh.lock; installer CI runsinstallers/test-install.sh.Reviewed by Cursor Bugbot for commit 5fb06d3. Bugbot is set up for automated code reviews on this repo. Configure here.