Skip to content

Audit round 4, phase C: fix the four findings that were ours - #8

Merged
godzillacode0000 merged 1 commit into
mainfrom
claude/hermes-plugin-readonly-audit-5u7anz
Oct 6, 2026
Merged

godzillacode0000 merged 1 commit into
mainfrom
claude/hermes-plugin-readonly-audit-5u7anz

Conversation

@godzillacode0000

Copy link
Copy Markdown
Owner

Summary

The four findings from the phase C engine matrix that were ours to fix. The engine-side findings (a request.security call reached only under a last-bar condition returns NaN or throws, the for bound re-evaluation, and the rest) are upstream and are not in this PR.

  • docs/studies/pine/fvg-mitigation.pine failed at its default inputs on any data without a gap yet (Index 0 is out of bounds [array.get]). A Pine for whose upper bound is below its start counts down, so for i = 0 to shown - 1 with shown == 0 still ran. The draw block is now guarded by array.size(gaps) > 0. Its stale comment that PineTS refuses while is gone (while runs).
  • An all-empty run (every plot line without a value, nothing else drawn) read as a normal "Ran · 0 series". It now adds a note: "nothing was plotted: “s” has no value on any of these N bars — a lookback longer than the history (an input set higher than the bars allow), or a condition that never held". It shows on the status line, in the run list and in the agent's reply, and only when nothing else is on the chart.
  • input.timeframe accepted "banana". Pine's spellings ("", "15", "240", "D", "1D", "4H", "W", "3M", "30S") are accepted; anything else is refused with a sentence, in the pane and for the agent.
  • Higher-timeframe rows are now used oldest-first, one per bar time (tidyRows in the worker's source). Newest-first rows made request.security return NaN on every bar. /api/bars is already ascending, so for it nothing changes.

Testing

  • New test_audit_round4_fixes.py (10 tests): the repo's study scripts run on flat, trending and sine data; the unguarded fvg-mitigation is the control and fails with the audit's exact error; timeframe table; tidyRows; emptyPlots and its wiring. Each fix is mutation-checked.
  • Driven in Chromium: Length set to 900 on 500 bars shows "Ran · 0 series · … ⚠ 1" with the new note in the run list; a first normal run is unchanged.
  • Full suite: 1017 tests, no failures (77 skipped without fastmcp / a real engine).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GLsbckEp88WEwC41dfyMeS


Generated by Claude Code

- fvg-mitigation.pine: guard the draw block with array.size(gaps) > 0 (a Pine `for` with the upper bound below
  the start counts down, so `for i = 0 to -1` ran and read an empty array); drop the stale "while is refused"
- an all-empty run (every plot line without a value, nothing else drawn) now says so instead of "Ran · 0 series"
- input.timeframe accepts Pine's spellings only; anything else is refused with a sentence
- higher-timeframe rows are sorted oldest-first and deduplicated in the worker's source (newest-first rows made
  request.security return NaN everywhere)
- test_audit_round4_fixes.py: study scripts run on flat/trend/sine data (the unguarded script is the control),
  timeframe table, tidyRows, emptyPlots and its wiring; each fix mutation-checked; the empty-run note and the
  timeframe refusal driven in Chromium. 1017 tests.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GLsbckEp88WEwC41dfyMeS
@coldtea-pr-lens

coldtea-pr-lens Bot commented Oct 6, 2026 •

Copy link
Copy Markdown

✅ Clean pass · c870330 looks sound on architecture, data flow and security


Architecture

Architecture diagram for godzillacode0000/tradersagent-plugin at c870330

Play the walkthrough


Inside the changed components — 2 views

Component view — Multi-timeframe Data Ingestion

Higher-timeframe bars fetched from the backend are ordered and deduplicated before PineTS evaluation.

Architecture view of Component view — Multi-timeframe Data Ingestion in godzillacode0000/tradersagent-plugin

Component view — Script Execution & Diagnostics

The unified runner checks for empty plot series and surfaces clear diagnostics to the UI and agent.

Architecture view of Component view — Script Execution & Diagnostics in godzillacode0000/tradersagent-plugin

Data flow

Data flow diagram for godzillacode0000/tradersagent-plugin at c870330

Follow each request


View

  • Architecture lens
  • Data flow lens
  • Expand every detail

Tip

Open a diagram on the canvas, then press W or click play to walk through the change one step at a time

🪧 More tips
  • Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
  • Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists
  • Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds
  • Click the link under each diagram to open it on a canvas you can zoom, pan and step through
  • The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change
  • The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time
  • Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs as before
  • Set github.draw: on-demand in .github/pr-lens.yml and PR Lens stops drawing pull requests on its own. Comment @pr-lens draw on a pull request when you want that one drawn
  • Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works
  • Push a commit and the drawing stays, with a note that it is out of date. Tick Redraw in the note to draw the new head
  • Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

@godzillacode0000
godzillacode0000 merged commit 52b2e35 into main Oct 6, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants