Repository navigation
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 31 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (14)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. Summary by CodeRabbit
WalkthroughThe changes update pinned development dependencies, add managed ChangesCertification and Extension Setup
Merge Driver Dependency Detection
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Other Merge Risk: ⚪ Minimal · up to The dependency update is consistent with the lockfile. Certification remains in progress because the documented SDK replacement issue is unresolved. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The added CI step has read-only repository permissions and stops on installation or version-check failure. No new privilege escalation is demonstrated. Downloaded extension behavior and the host SDK’s documented replacement failure remain unresolved. Retained concerns Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR certifies the repository against PM CLI/SDK 2026.10.4 by consolidating exact dependency updates, adding reproducible acceptance and blocker receipts, restoring managed pm-github artifacts in CI, and hardening merge-driver resolution. The certification is intentionally not ready to merge because the audited SDK still fails the existing replace-mode assertion for omitted raw governance keys, with no test weakening or workaround applied. Sequence diagram for CI restoration and PM health verificationsequenceDiagram
participant CI
participant Installer as install-pm-github.sh
participant PM as PM CLI 2026.10.4
participant Registry as .managed-extensions.json
participant Health as pm health
CI->>Installer: run
Installer->>PM: package install npm:pm-github@2026.10.4 --project
PM-->>Installer: install managed extension artifacts
Installer->>Registry: git restore
Installer-->>CI: verified package and restored registry
CI->>Health: --strict-exit --require-merge-drivers
Health-->>CI: exit 0
Sequence diagram for SDK replace-mode regressionsequenceDiagram
participant Repro as SDK-1394-repro.mjs
participant SDK as createExtensionCommandSdk
participant Callback as mutate callback
participant Settings as settings.json
Repro->>Settings: write governance.certification_leftover
Repro->>SDK: mutateWorkspaceSettings
SDK->>Callback: mutate(current)
Callback-->>SDK: governance.preset only
SDK-->>Repro: preview omits certification_leftover
SDK->>Settings: persist mutation
Settings-->>Repro: certification_leftover retained
Repro->>Repro: assert.equal
Flow diagram for PM CLI 2026.10.4 certification statusflowchart TD
A[Pin CLI SDK and PM tooling to 2026.10.4] --> B[Run launcher and acceptance checks]
B --> C{All certification checks pass?}
C -->|Yes| D[Certification ready]
C -->|No| E[158 of 159 release checks pass]
E --> F[SDK #1394 replace-mode blocker]
F --> G[Not ready to merge]
G --> H[Await upstream SDK fix]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
 |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Re this comment: This is an automatic-review eligibility skip for a repository below the star threshold, not a code review. A manual review request is being posted. No repository policy or gate was weakened to suppress it. |
|
Re this comment: Useful summary acknowledged. No new actionable finding was supplied. The unchanged replace-mode assertion remains red (158/159); independently reproduced upstream pm-cli #1394 owns the SDK defect. Neither the successful packed workflow nor this summary resolves that blocker. |
|
Re this comment: Useful summary acknowledged. No new actionable finding was supplied. The unchanged replace-mode assertion remains red (158/159); independently reproduced upstream pm-cli #1394 owns the SDK defect. Neither the successful packed workflow nor this summary resolves that blocker. |
|
Re this comment: This review body reports an exhausted review quota and supplies no source findings. It remains unavailable evidence, rather than approval; the reported tests and remaining blockers are independent. |
|
The edited review now covers 31ee4a3 with no actionable findings; acknowledged. The unchanged replace-mode guard still fails because of reproduced SDK issue #1394; passing configured coverage does not establish gate success. This replaces the earlier automatic-skip assessment. Other unavailable reviewer evidence remains pending. |
|
Review command completion acknowledged; the substantive summary explicitly covers 31ee4a3 and reports no actionable findings. The unchanged replace-mode guard still fails because of reproduced SDK issue #1394; passing configured coverage does not establish gate success. |
|
@coderabbitai review |
|
The newly edited summary skips automatic review of a72365d (fewer than10stars) while retaining its earlier source-candidate review. This skip is not approval of the final metadata head. Greptile independently reviewed the latest head; unchanged source receipts and earlier manual review remain scoped to their recorded SHAs. |
|
Acknowledged the updated substantive review explicitly covering a72365d, with no new actionable findings. Known certification blockers remain documented; zero unresolved threads and green configured checks do not replace missing reviewer evidence. |
|
|
The re-review command was rate limited. This is unavailable review evidence, not approval. The earlier substantive source review remains scoped to its recorded commit; the final metadata head is independently covered by current CI and Greptile. |
|
The edited comment now explicitly rate-limits review of the final metadata diff. The retained no-actionable summary describes the earlier source candidate. This does not constitute exact-final-head review clearance; quota and missing reviewer responses remain open in the handoff. |
|
Closing as superseded. Fleet rule (2026-10-04): pm CLI/SDK bumps no longer go through hand-written certification PRs; the daily grouped |
Pins PM CLI/SDK, pm-ops, pm-changelog and managed pm-github to 2026.10.4, with exact development versions and the unchanged 2026.9.30 SDK floor. Consolidates Dependabot #111, #112, #114 and #115, including the exact CodeQL SHA/comment bump. Copies the published merge-driver launcher unchanged and adds its real malformed-lookup regression. Tracks managed pm-github metadata and restores downloaded artifacts before CI health.
NOT READY:
npm run release:checkhas 158/159 pass, zero skips. The unchanged replace-mode assertion exposes upstream pm-cli #1394: the audited SDK cannot remove omitted raw governance keys invisible to its normalized callback. Independent SDK-only disposable reproduction is committed asdocs/SDK-1394-repro.mjs. No audit bypass, ignored failure, lower threshold or weakened assertion.Other receipts (heavy commands serialized with the shared flock):
npm audit --omit=devandnpm audit: zero vulnerabilities.npx pm health --strict-exit --require-merge-drivers: exit 0, one advisory stale-item finding.npm packinstalled into a copied real tracker. npm/npx and native Bun (bunx --bun @unbrained/pm-cli@2026.10.4) passed catalog/list, validate, show, diff, preview, export and all seven presets in merge/replace modes. Catalogs matched, both exports parsed, scratch deleted. This does not resolve the omitted-raw-key regression.Exact commands and receipts.
PM: certification pm-kewj, SDK blocker pm-yatu, existing quality owner pm-915f. Orchestrator verifies, merges and closes items after blockers are resolved.
Summary by Sourcery
Certify the project against PM tooling 2026.10.4 while hardening merge-driver setup and documenting the remaining upstream SDK replacement blocker.
New Features:
Bug Fixes:
Enhancements:
Build:
CI:
Documentation:
Tests:
Chores:
Summary by cubic
Certifies the project against PM tooling 2026.10.4 releases, but the release gate stays red on one assertion blocked by an upstream SDK bug.
Pins
@unbrained/pm-cli,pm-ops,pm-changelog,@types/node, andtypescriptto exact versions, consolidating Dependabot #111, #112, #114, and #115. The SDK compatibility floor inpeerDependenciesstays at 2026.9.30.Not ready to merge
npm run release:checkpasses 158/159 tests with zero skips. The unchanged replace-mode assertion fails because the audited SDK cannot remove omitted raw governance keys: the callback and preview omit the key, but the persisted file retains it. This is reproduced independently indocs/SDK-1394-repro.mjsand filed upstream as pm-cli#1394. The assertion is not weakened, no audit bypass is used, and certification is blocked on the upstream fix. Manual CodeRabbit and Greptile reviews at the reviewed head report no actionable findings with zero unresolved threads; the missing review evidence is Sourcery quota, cubic neutral status, and absent Gemini/Copilot responses.Other changes:
prepare-merge-driver.tsto fail closed when a module lookup path is unreadable or malformed, with regression coverage.pm-githubartifacts before the health check and tracks the extension registry; downloaded artifacts are gitignored.docs/certification-2026.10.4.md) and PM tracking items.Written for commit a72365d. Summary will update on new commits.