fix: feed entity-salience reflex from claude-code's context hook; wire codex (#425)#459
Open
Tet-9 wants to merge 1 commit into
Open
fix: feed entity-salience reflex from claude-code's context hook; wire codex (#425)#459Tet-9 wants to merge 1 commit into
Tet-9 wants to merge 1 commit into
Conversation
…e codex (vouchdev#425) claude-code's UserPromptSubmit hook (context-hook / build_claude_prompt_hook) computed retrieval via build_context_pack but never recorded the prompt into the entity-salience reflex (vouchdev#223) -- salience.record_query was simply never called from the hook path, leaving the reflex permanently dormant for every claude-code session. Fixed additively: record_query now runs when a session_id is present, wrapped so a salience failure can never break the hook's real contract (never raises, never blocks the turn). codex exposes UserPromptSubmit with the same {prompt, session_id, ...} payload and additionalContext response shape as claude-code, so the existing context-hook command now serves both hosts unmodified -- wired via a new hooks.json entry alongside the existing Stop (session capture) hook. OpenClaw needed no changes: its context-engine slot (src/vouch/openclaw/context_engine.py) already calls record_query/attach_salience correctly on every assemble() -- a separate, already-correct code path from the claude-code/codex hooks.py one this fixes. cursor is not wired: its beforeSubmitPrompt hook is validation/block-only and cannot inject additionalContext (confirmed against Cursor's docs; an open Cursor feature request asks for exactly this, unresolved). Documented in adapters/cursor/install.yaml rather than silently skipped.
📝 WalkthroughWalkthroughThis PR expands retrieval, embeddings, health diagnostics, bundle integrity, MCP and JSONL tools, session handling, and Codex prompt hooks. It adds security-audit automation and Vouch records, while removing the desktop application and several specification, configuration, and documentation files. ChangesCore platform and integration changes
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
docs
github-actions
Bot
added
size: S
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (2)
tests/test_install_adapter.py (1)
577-590: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd
hooks_path.is_file()assertion for consistency with existing tests.The existing
test_codex_t4_writes_hooks_json(line 534) assertshooks_path.is_file()before reading. The new test readshooks_path.read_text()directly — if the file is missing, the failure presents as aFileNotFoundErrorrather than a clear assertion message.♻️ Suggested fix
result = install("codex", target=tmp_path, tier="T4") hooks_path = tmp_path / ".codex" / "hooks.json" + assert hooks_path.is_file() data = json.loads(hooks_path.read_text(encoding="utf-8"))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_install_adapter.py` around lines 577 - 590, Add an explicit hooks_path.is_file() assertion in test_codex_t4_writes_user_prompt_submit_hook before reading hooks_path, matching test_codex_t4_writes_hooks_json and providing a clear failure when the file is missing.src/vouch/context.py (1)
346-359: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReturn type annotation is misleading — function always returns a dict.
build_context_packis annotated-> ContextPack | dict[str, Any], but the body always callspack.model_dump()and returns adict[str, Any]. TheContextPackbranch is never taken, so any caller doingisinstance(result, ContextPack)has dead code. If the union is kept for backward compatibility during a gradual migration, a brief comment explaining why would help future readers.♻️ Suggested fix
-) -> ContextPack | dict[str, Any]: +) -> dict[str, Any]:If callers still depend on the union for type-checking during migration, alternatively add a comment:
) -> ContextPack | dict[str, Any]: + # Always returns a dict (model_dump). Union kept for caller + # type-compat during the migration off raw ContextPack returns.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/vouch/context.py` around lines 346 - 359, Update the return annotation of build_context_pack to dict[str, Any], matching its unconditional pack.model_dump() return value, and remove any dead ContextPack type handling in callers. If backward compatibility requires retaining the union, add a brief comment documenting the migration rationale.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security-audit.yml:
- Around line 21-25: Move continue-on-error: true from the job definition to the
pip-audit audit step in the security workflow. Keep setup steps such as
checkout, Python configuration, and dependency installation blocking on failure,
while allowing only vulnerability findings from the audit command to be
non-blocking.
In @.vouch/captures/ec4b8842-f167-467e-a33c-dc87911c9e0e.jsonl:
- Around line 1-36: Remove the raw shell-history capture containing host paths,
account activity, repository details, and mutating commands; do not commit this
session record. Replace it with a sanitized, normalized artifact containing only
derived project facts, or redact sensitive metadata and command history before
committing.
In @.vouch/decided/20260707-092531-154cb163.yaml:
- Around line 41-45: Replace the placeholder decision_reason value "yes" with
the actual rationale for the rejected decision, preserving the existing schema
and YAML structure; use null only if the schema explicitly allows an absent
reason.
In @.vouch/decided/20260707-093005-05345f47.yaml:
- Around line 19-21: Redact the machine-local filesystem paths in the durable
session summary, including entries under /home/a/.claude and /tmp/claude-1000.
Replace them with repository-relative references where applicable, or remove
them if no portable equivalent exists.
In
@.vouch/pages/session-what-are-the-non-development-related-files-and-folde.md:
- Around line 36-38: Remove or sanitize the machine-specific `/home/a/...` and
`/tmp/...` entries in the session-record page, including the corresponding
entries at the additionally referenced section, replacing them with generic
placeholders or omitting them before committing.
In `@CONTRIBUTING.md`:
- Around line 128-130: Update the contribution requirements to require evidence
appropriate to the changed interface: request vouch-ui screenshots or screen
recordings for webapp changes, and terminal transcripts or equivalent evidence
for CLI output, hooks, or other non-webapp user-facing behavior.
In `@docs/superpowers/specs/2026-07-06-review-ui-multi-kb-design.md`:
- Around line 4-9: Update the status note to reference an immutable commit SHA
or release tag for the shipped implementation instead of the local vouch-ui path
alone, and explicitly label the unpushed feat/review-ui-multi-kb branch as
reference-only.
In `@src/vouch/server.py`:
- Around line 853-864: Remove the unused backfill parameter from
kb_reindex_embeddings and update its callers or, if the flag is required by the
API, pass it through to backfill_embeddings so it changes behavior. Ensure the
function signature, invocation, and related documentation consistently reflect
the chosen behavior.
---
Nitpick comments:
In `@src/vouch/context.py`:
- Around line 346-359: Update the return annotation of build_context_pack to
dict[str, Any], matching its unconditional pack.model_dump() return value, and
remove any dead ContextPack type handling in callers. If backward compatibility
requires retaining the union, add a brief comment documenting the migration
rationale.
In `@tests/test_install_adapter.py`:
- Around line 577-590: Add an explicit hooks_path.is_file() assertion in
test_codex_t4_writes_user_prompt_submit_hook before reading hooks_path, matching
test_codex_t4_writes_hooks_json and providing a clear failure when the file is
missing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e2cd023b-a81e-466a-9c38-706e0284211e
⛔ Files ignored due to path filters (6)
desktop/docs/screenshots/browse.pngis excluded by!**/*.pngdesktop/docs/screenshots/dashboard.pngis excluded by!**/*.pngdesktop/docs/screenshots/dual-solve.pngis excluded by!**/*.pngdesktop/docs/screenshots/review.pngis excluded by!**/*.pngdesktop/package-lock.jsonis excluded by!**/package-lock.jsondocs/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (128)
.github/workflows/security-audit.yml.pre-commit-config.yaml.vouch/captures/1218169c-de25-48f4-bd93-70ff77d2fda2.jsonl.vouch/captures/5720220c-b77c-4947-aeec-9d6ef91d70b8.jsonl.vouch/captures/8a6df051-6c56-4d86-b0ed-66f6638ecfdc.jsonl.vouch/captures/ec4b8842-f167-467e-a33c-dc87911c9e0e.jsonl.vouch/claims/vouch-starter-reviewed-knowledge.yaml.vouch/decided/20260707-092531-154cb163.yaml.vouch/decided/20260707-093005-05345f47.yaml.vouch/decided/20260707-093125-4d6972f9.yaml.vouch/pages/edit-in-obsidian.md.vouch/pages/reviewed-knowledge-store.md.vouch/pages/session-what-are-the-non-development-related-files-and-folde.md.vouch/schema_version.vouch/sources/be7aec64b0fc803a33cb3d610f67ae95e636877db20231ef72440a7cbe6b69d2/content.vouch/sources/be7aec64b0fc803a33cb3d610f67ae95e636877db20231ef72440a7cbe6b69d2/meta.yamlCHANGELOG.mdCONTRIBUTING.mdREADME.mdadapters/codex/hooks.jsonadapters/codex/install.yamladapters/cursor/install.yamladapters/openclaw/install.yamldesktop/.gitignoredesktop/CHANGELOG.mddesktop/LICENSEdesktop/README.mddesktop/docs/architecture.mddesktop/docs/reports/2026-06-26.mddesktop/electron-builder.ymldesktop/electron.vite.config.tsdesktop/package.jsondesktop/resources/vouch/.gitkeepdesktop/scripts/dev-with-vouch.tsdesktop/scripts/gen-methods.tsdesktop/src/catalog/backend.jsondesktop/src/catalog/methods.jsondesktop/src/main/http-client.tsdesktop/src/main/index.tsdesktop/src/main/ipc.tsdesktop/src/main/jsonl-client.tsdesktop/src/main/kb-store.tsdesktop/src/main/supervisor.tsdesktop/src/main/tray.tsdesktop/src/main/types.tsdesktop/src/main/vouch-locator.tsdesktop/src/preload/index.tsdesktop/src/renderer/index.htmldesktop/src/renderer/src/App.tsxdesktop/src/renderer/src/app.cssdesktop/src/renderer/src/components/Diff.tsxdesktop/src/renderer/src/components/Drawer.tsxdesktop/src/renderer/src/components/EmptyState.tsxdesktop/src/renderer/src/components/MethodCard.tsxdesktop/src/renderer/src/components/MethodForm.tsxdesktop/src/renderer/src/components/Placeholder.tsxdesktop/src/renderer/src/components/Rail.tsxdesktop/src/renderer/src/components/StatusBar.tsxdesktop/src/renderer/src/components/Topbar.tsxdesktop/src/renderer/src/components/controls/index.tsxdesktop/src/renderer/src/components/results/Cards.tsxdesktop/src/renderer/src/components/results/JsonTree.tsxdesktop/src/renderer/src/components/results/Renderers.tsxdesktop/src/renderer/src/components/results/ResultView.tsxdesktop/src/renderer/src/components/results/atoms.tsxdesktop/src/renderer/src/global.d.tsdesktop/src/renderer/src/lib/VouchContext.tsxdesktop/src/renderer/src/lib/client.tsdesktop/src/renderer/src/lib/format.tsdesktop/src/renderer/src/lib/useOnOpen.tsxdesktop/src/renderer/src/lib/useVouchEvents.tsdesktop/src/renderer/src/main.tsxdesktop/src/renderer/src/views/Dashboard.tsxdesktop/src/renderer/src/views/DualSolve.tsxdesktop/src/renderer/src/views/GenericView.tsxdesktop/src/renderer/src/views/Review.tsxdesktop/src/renderer/src/views/blurbs.tsdesktop/src/renderer/src/views/registry.tsxdesktop/src/shared/ipc.tsdesktop/src/shared/methods.gen.tsdesktop/src/shared/methods.types.tsdesktop/test/catalog.test.tsdesktop/test/controls.test.tsxdesktop/test/gen-methods.test.tsdesktop/test/http-client.test.tsdesktop/test/jsonl-client.test.tsdesktop/test/method-card.test.tsxdesktop/test/method-form.test.tsxdesktop/test/method-gate.test.tsdesktop/test/smoke-jsonl.tsdesktop/test/vouch-locator.test.tsdesktop/tsconfig.jsondesktop/tsconfig.node.jsondesktop/tsconfig.scripts.jsondesktop/tsconfig.web.jsondesktop/vitest.config.tsdocs/superpowers/specs/2026-07-06-review-ui-multi-kb-design.mdmigrations/README.mdspec/2026-05-21/README.mdspec/2026-05-21/SPEC.mdspec/2026-05-21/audit-vocabulary.mdspec/2026-05-21/methods.mdspec/2026-05-21/retrieval.mdspec/2026-05-21/review-gate.mdspec/2026-05-21/transports.mdspec/README.mdspec/audit-vocabulary.mdspec/methods.mdspec/retrieval.mdspec/review-gate.mdspec/transports.mdsrc/vouch/bundle.pysrc/vouch/cli.pysrc/vouch/context.pysrc/vouch/embeddings/base.pysrc/vouch/health.pysrc/vouch/hooks.pysrc/vouch/index_db.pysrc/vouch/jsonl_server.pysrc/vouch/server.pysrc/vouch/sessions.pysrc/vouch/storage.pytests/embeddings/conftest.pytests/embeddings/test_integration.pytests/embeddings/test_search.pytests/test_cli.pytests/test_hooks.pytests/test_install_adapter.py
💤 Files with no reviewable changes (87)
- desktop/LICENSE
- spec/retrieval.md
- desktop/src/renderer/src/components/Placeholder.tsx
- desktop/docs/reports/2026-06-26.md
- desktop/test/catalog.test.ts
- desktop/src/main/kb-store.ts
- desktop/src/renderer/src/views/blurbs.ts
- desktop/src/renderer/src/App.tsx
- desktop/test/jsonl-client.test.ts
- desktop/package.json
- desktop/README.md
- spec/README.md
- spec/transports.md
- desktop/test/http-client.test.ts
- desktop/src/renderer/src/components/StatusBar.tsx
- spec/methods.md
- spec/2026-05-21/retrieval.md
- desktop/src/renderer/src/components/EmptyState.tsx
- desktop/src/renderer/index.html
- desktop/src/renderer/src/lib/format.ts
- migrations/README.md
- spec/2026-05-21/methods.md
- spec/2026-05-21/review-gate.md
- desktop/src/main/supervisor.ts
- desktop/src/renderer/src/components/Drawer.tsx
- .pre-commit-config.yaml
- desktop/src/renderer/src/global.d.ts
- desktop/test/method-gate.test.ts
- desktop/CHANGELOG.md
- spec/2026-05-21/transports.md
- desktop/scripts/dev-with-vouch.ts
- spec/audit-vocabulary.md
- desktop/src/main/ipc.ts
- desktop/src/renderer/src/views/registry.tsx
- desktop/src/main/types.ts
- desktop/src/renderer/src/main.tsx
- desktop/vitest.config.ts
- spec/2026-05-21/README.md
- desktop/src/renderer/src/views/Review.tsx
- desktop/tsconfig.web.json
- desktop/.gitignore
- desktop/src/main/http-client.ts
- desktop/test/method-card.test.tsx
- desktop/src/renderer/src/components/MethodCard.tsx
- desktop/src/renderer/src/components/Rail.tsx
- desktop/test/controls.test.tsx
- spec/review-gate.md
- desktop/electron-builder.yml
- desktop/src/renderer/src/app.css
- desktop/src/catalog/backend.json
- desktop/src/shared/methods.gen.ts
- desktop/electron.vite.config.ts
- desktop/test/vouch-locator.test.ts
- desktop/src/renderer/src/components/Diff.tsx
- spec/2026-05-21/SPEC.md
- desktop/src/renderer/src/components/results/ResultView.tsx
- desktop/scripts/gen-methods.ts
- desktop/src/renderer/src/components/results/atoms.tsx
- desktop/src/renderer/src/lib/VouchContext.tsx
- desktop/src/main/tray.ts
- desktop/src/renderer/src/components/MethodForm.tsx
- desktop/src/renderer/src/components/results/JsonTree.tsx
- desktop/tsconfig.node.json
- desktop/src/renderer/src/lib/useOnOpen.tsx
- desktop/test/method-form.test.tsx
- spec/2026-05-21/audit-vocabulary.md
- desktop/src/main/vouch-locator.ts
- desktop/src/renderer/src/lib/client.ts
- desktop/src/renderer/src/views/GenericView.tsx
- desktop/tsconfig.scripts.json
- desktop/src/shared/methods.types.ts
- desktop/test/gen-methods.test.ts
- desktop/tsconfig.json
- desktop/src/catalog/methods.json
- desktop/src/renderer/src/components/Topbar.tsx
- desktop/src/renderer/src/lib/useVouchEvents.ts
- desktop/docs/architecture.md
- desktop/src/renderer/src/views/DualSolve.tsx
- desktop/test/smoke-jsonl.ts
- desktop/src/shared/ipc.ts
- desktop/src/main/index.ts
- desktop/src/preload/index.ts
- desktop/src/renderer/src/components/results/Renderers.tsx
- desktop/src/main/jsonl-client.ts
- desktop/src/renderer/src/components/controls/index.tsx
- desktop/src/renderer/src/components/results/Cards.tsx
- desktop/src/renderer/src/views/Dashboard.tsx
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 8
🧹 Nitpick comments (2)
tests/test_install_adapter.py (1)
577-590: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd
hooks_path.is_file()assertion for consistency with existing tests.The existing
test_codex_t4_writes_hooks_json(line 534) assertshooks_path.is_file()before reading. The new test readshooks_path.read_text()directly — if the file is missing, the failure presents as aFileNotFoundErrorrather than a clear assertion message.♻️ Suggested fix
result = install("codex", target=tmp_path, tier="T4") hooks_path = tmp_path / ".codex" / "hooks.json" + assert hooks_path.is_file() data = json.loads(hooks_path.read_text(encoding="utf-8"))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_install_adapter.py` around lines 577 - 590, Add an explicit hooks_path.is_file() assertion in test_codex_t4_writes_user_prompt_submit_hook before reading hooks_path, matching test_codex_t4_writes_hooks_json and providing a clear failure when the file is missing.src/vouch/context.py (1)
346-359: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReturn type annotation is misleading — function always returns a dict.
build_context_packis annotated-> ContextPack | dict[str, Any], but the body always callspack.model_dump()and returns adict[str, Any]. TheContextPackbranch is never taken, so any caller doingisinstance(result, ContextPack)has dead code. If the union is kept for backward compatibility during a gradual migration, a brief comment explaining why would help future readers.♻️ Suggested fix
-) -> ContextPack | dict[str, Any]: +) -> dict[str, Any]:If callers still depend on the union for type-checking during migration, alternatively add a comment:
) -> ContextPack | dict[str, Any]: + # Always returns a dict (model_dump). Union kept for caller + # type-compat during the migration off raw ContextPack returns.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/vouch/context.py` around lines 346 - 359, Update the return annotation of build_context_pack to dict[str, Any], matching its unconditional pack.model_dump() return value, and remove any dead ContextPack type handling in callers. If backward compatibility requires retaining the union, add a brief comment documenting the migration rationale.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security-audit.yml:
- Around line 21-25: Move continue-on-error: true from the job definition to the
pip-audit audit step in the security workflow. Keep setup steps such as
checkout, Python configuration, and dependency installation blocking on failure,
while allowing only vulnerability findings from the audit command to be
non-blocking.
In @.vouch/captures/ec4b8842-f167-467e-a33c-dc87911c9e0e.jsonl:
- Around line 1-36: Remove the raw shell-history capture containing host paths,
account activity, repository details, and mutating commands; do not commit this
session record. Replace it with a sanitized, normalized artifact containing only
derived project facts, or redact sensitive metadata and command history before
committing.
In @.vouch/decided/20260707-092531-154cb163.yaml:
- Around line 41-45: Replace the placeholder decision_reason value "yes" with
the actual rationale for the rejected decision, preserving the existing schema
and YAML structure; use null only if the schema explicitly allows an absent
reason.
In @.vouch/decided/20260707-093005-05345f47.yaml:
- Around line 19-21: Redact the machine-local filesystem paths in the durable
session summary, including entries under /home/a/.claude and /tmp/claude-1000.
Replace them with repository-relative references where applicable, or remove
them if no portable equivalent exists.
In
@.vouch/pages/session-what-are-the-non-development-related-files-and-folde.md:
- Around line 36-38: Remove or sanitize the machine-specific `/home/a/...` and
`/tmp/...` entries in the session-record page, including the corresponding
entries at the additionally referenced section, replacing them with generic
placeholders or omitting them before committing.
In `@CONTRIBUTING.md`:
- Around line 128-130: Update the contribution requirements to require evidence
appropriate to the changed interface: request vouch-ui screenshots or screen
recordings for webapp changes, and terminal transcripts or equivalent evidence
for CLI output, hooks, or other non-webapp user-facing behavior.
In `@docs/superpowers/specs/2026-07-06-review-ui-multi-kb-design.md`:
- Around line 4-9: Update the status note to reference an immutable commit SHA
or release tag for the shipped implementation instead of the local vouch-ui path
alone, and explicitly label the unpushed feat/review-ui-multi-kb branch as
reference-only.
In `@src/vouch/server.py`:
- Around line 853-864: Remove the unused backfill parameter from
kb_reindex_embeddings and update its callers or, if the flag is required by the
API, pass it through to backfill_embeddings so it changes behavior. Ensure the
function signature, invocation, and related documentation consistently reflect
the chosen behavior.
---
Nitpick comments:
In `@src/vouch/context.py`:
- Around line 346-359: Update the return annotation of build_context_pack to
dict[str, Any], matching its unconditional pack.model_dump() return value, and
remove any dead ContextPack type handling in callers. If backward compatibility
requires retaining the union, add a brief comment documenting the migration
rationale.
In `@tests/test_install_adapter.py`:
- Around line 577-590: Add an explicit hooks_path.is_file() assertion in
test_codex_t4_writes_user_prompt_submit_hook before reading hooks_path, matching
test_codex_t4_writes_hooks_json and providing a clear failure when the file is
missing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e2cd023b-a81e-466a-9c38-706e0284211e
⛔ Files ignored due to path filters (6)
desktop/docs/screenshots/browse.pngis excluded by!**/*.pngdesktop/docs/screenshots/dashboard.pngis excluded by!**/*.pngdesktop/docs/screenshots/dual-solve.pngis excluded by!**/*.pngdesktop/docs/screenshots/review.pngis excluded by!**/*.pngdesktop/package-lock.jsonis excluded by!**/package-lock.jsondocs/banner.svgis excluded by!**/*.svg
📒 Files selected for processing (128)
.github/workflows/security-audit.yml.pre-commit-config.yaml.vouch/captures/1218169c-de25-48f4-bd93-70ff77d2fda2.jsonl.vouch/captures/5720220c-b77c-4947-aeec-9d6ef91d70b8.jsonl.vouch/captures/8a6df051-6c56-4d86-b0ed-66f6638ecfdc.jsonl.vouch/captures/ec4b8842-f167-467e-a33c-dc87911c9e0e.jsonl.vouch/claims/vouch-starter-reviewed-knowledge.yaml.vouch/decided/20260707-092531-154cb163.yaml.vouch/decided/20260707-093005-05345f47.yaml.vouch/decided/20260707-093125-4d6972f9.yaml.vouch/pages/edit-in-obsidian.md.vouch/pages/reviewed-knowledge-store.md.vouch/pages/session-what-are-the-non-development-related-files-and-folde.md.vouch/schema_version.vouch/sources/be7aec64b0fc803a33cb3d610f67ae95e636877db20231ef72440a7cbe6b69d2/content.vouch/sources/be7aec64b0fc803a33cb3d610f67ae95e636877db20231ef72440a7cbe6b69d2/meta.yamlCHANGELOG.mdCONTRIBUTING.mdREADME.mdadapters/codex/hooks.jsonadapters/codex/install.yamladapters/cursor/install.yamladapters/openclaw/install.yamldesktop/.gitignoredesktop/CHANGELOG.mddesktop/LICENSEdesktop/README.mddesktop/docs/architecture.mddesktop/docs/reports/2026-06-26.mddesktop/electron-builder.ymldesktop/electron.vite.config.tsdesktop/package.jsondesktop/resources/vouch/.gitkeepdesktop/scripts/dev-with-vouch.tsdesktop/scripts/gen-methods.tsdesktop/src/catalog/backend.jsondesktop/src/catalog/methods.jsondesktop/src/main/http-client.tsdesktop/src/main/index.tsdesktop/src/main/ipc.tsdesktop/src/main/jsonl-client.tsdesktop/src/main/kb-store.tsdesktop/src/main/supervisor.tsdesktop/src/main/tray.tsdesktop/src/main/types.tsdesktop/src/main/vouch-locator.tsdesktop/src/preload/index.tsdesktop/src/renderer/index.htmldesktop/src/renderer/src/App.tsxdesktop/src/renderer/src/app.cssdesktop/src/renderer/src/components/Diff.tsxdesktop/src/renderer/src/components/Drawer.tsxdesktop/src/renderer/src/components/EmptyState.tsxdesktop/src/renderer/src/components/MethodCard.tsxdesktop/src/renderer/src/components/MethodForm.tsxdesktop/src/renderer/src/components/Placeholder.tsxdesktop/src/renderer/src/components/Rail.tsxdesktop/src/renderer/src/components/StatusBar.tsxdesktop/src/renderer/src/components/Topbar.tsxdesktop/src/renderer/src/components/controls/index.tsxdesktop/src/renderer/src/components/results/Cards.tsxdesktop/src/renderer/src/components/results/JsonTree.tsxdesktop/src/renderer/src/components/results/Renderers.tsxdesktop/src/renderer/src/components/results/ResultView.tsxdesktop/src/renderer/src/components/results/atoms.tsxdesktop/src/renderer/src/global.d.tsdesktop/src/renderer/src/lib/VouchContext.tsxdesktop/src/renderer/src/lib/client.tsdesktop/src/renderer/src/lib/format.tsdesktop/src/renderer/src/lib/useOnOpen.tsxdesktop/src/renderer/src/lib/useVouchEvents.tsdesktop/src/renderer/src/main.tsxdesktop/src/renderer/src/views/Dashboard.tsxdesktop/src/renderer/src/views/DualSolve.tsxdesktop/src/renderer/src/views/GenericView.tsxdesktop/src/renderer/src/views/Review.tsxdesktop/src/renderer/src/views/blurbs.tsdesktop/src/renderer/src/views/registry.tsxdesktop/src/shared/ipc.tsdesktop/src/shared/methods.gen.tsdesktop/src/shared/methods.types.tsdesktop/test/catalog.test.tsdesktop/test/controls.test.tsxdesktop/test/gen-methods.test.tsdesktop/test/http-client.test.tsdesktop/test/jsonl-client.test.tsdesktop/test/method-card.test.tsxdesktop/test/method-form.test.tsxdesktop/test/method-gate.test.tsdesktop/test/smoke-jsonl.tsdesktop/test/vouch-locator.test.tsdesktop/tsconfig.jsondesktop/tsconfig.node.jsondesktop/tsconfig.scripts.jsondesktop/tsconfig.web.jsondesktop/vitest.config.tsdocs/superpowers/specs/2026-07-06-review-ui-multi-kb-design.mdmigrations/README.mdspec/2026-05-21/README.mdspec/2026-05-21/SPEC.mdspec/2026-05-21/audit-vocabulary.mdspec/2026-05-21/methods.mdspec/2026-05-21/retrieval.mdspec/2026-05-21/review-gate.mdspec/2026-05-21/transports.mdspec/README.mdspec/audit-vocabulary.mdspec/methods.mdspec/retrieval.mdspec/review-gate.mdspec/transports.mdsrc/vouch/bundle.pysrc/vouch/cli.pysrc/vouch/context.pysrc/vouch/embeddings/base.pysrc/vouch/health.pysrc/vouch/hooks.pysrc/vouch/index_db.pysrc/vouch/jsonl_server.pysrc/vouch/server.pysrc/vouch/sessions.pysrc/vouch/storage.pytests/embeddings/conftest.pytests/embeddings/test_integration.pytests/embeddings/test_search.pytests/test_cli.pytests/test_hooks.pytests/test_install_adapter.py
💤 Files with no reviewable changes (87)
- desktop/LICENSE
- spec/retrieval.md
- desktop/src/renderer/src/components/Placeholder.tsx
- desktop/docs/reports/2026-06-26.md
- desktop/test/catalog.test.ts
- desktop/src/main/kb-store.ts
- desktop/src/renderer/src/views/blurbs.ts
- desktop/src/renderer/src/App.tsx
- desktop/test/jsonl-client.test.ts
- desktop/package.json
- desktop/README.md
- spec/README.md
- spec/transports.md
- desktop/test/http-client.test.ts
- desktop/src/renderer/src/components/StatusBar.tsx
- spec/methods.md
- spec/2026-05-21/retrieval.md
- desktop/src/renderer/src/components/EmptyState.tsx
- desktop/src/renderer/index.html
- desktop/src/renderer/src/lib/format.ts
- migrations/README.md
- spec/2026-05-21/methods.md
- spec/2026-05-21/review-gate.md
- desktop/src/main/supervisor.ts
- desktop/src/renderer/src/components/Drawer.tsx
- .pre-commit-config.yaml
- desktop/src/renderer/src/global.d.ts
- desktop/test/method-gate.test.ts
- desktop/CHANGELOG.md
- spec/2026-05-21/transports.md
- desktop/scripts/dev-with-vouch.ts
- spec/audit-vocabulary.md
- desktop/src/main/ipc.ts
- desktop/src/renderer/src/views/registry.tsx
- desktop/src/main/types.ts
- desktop/src/renderer/src/main.tsx
- desktop/vitest.config.ts
- spec/2026-05-21/README.md
- desktop/src/renderer/src/views/Review.tsx
- desktop/tsconfig.web.json
- desktop/.gitignore
- desktop/src/main/http-client.ts
- desktop/test/method-card.test.tsx
- desktop/src/renderer/src/components/MethodCard.tsx
- desktop/src/renderer/src/components/Rail.tsx
- desktop/test/controls.test.tsx
- spec/review-gate.md
- desktop/electron-builder.yml
- desktop/src/renderer/src/app.css
- desktop/src/catalog/backend.json
- desktop/src/shared/methods.gen.ts
- desktop/electron.vite.config.ts
- desktop/test/vouch-locator.test.ts
- desktop/src/renderer/src/components/Diff.tsx
- spec/2026-05-21/SPEC.md
- desktop/src/renderer/src/components/results/ResultView.tsx
- desktop/scripts/gen-methods.ts
- desktop/src/renderer/src/components/results/atoms.tsx
- desktop/src/renderer/src/lib/VouchContext.tsx
- desktop/src/main/tray.ts
- desktop/src/renderer/src/components/MethodForm.tsx
- desktop/src/renderer/src/components/results/JsonTree.tsx
- desktop/tsconfig.node.json
- desktop/src/renderer/src/lib/useOnOpen.tsx
- desktop/test/method-form.test.tsx
- spec/2026-05-21/audit-vocabulary.md
- desktop/src/main/vouch-locator.ts
- desktop/src/renderer/src/lib/client.ts
- desktop/src/renderer/src/views/GenericView.tsx
- desktop/tsconfig.scripts.json
- desktop/src/shared/methods.types.ts
- desktop/test/gen-methods.test.ts
- desktop/tsconfig.json
- desktop/src/catalog/methods.json
- desktop/src/renderer/src/components/Topbar.tsx
- desktop/src/renderer/src/lib/useVouchEvents.ts
- desktop/docs/architecture.md
- desktop/src/renderer/src/views/DualSolve.tsx
- desktop/test/smoke-jsonl.ts
- desktop/src/shared/ipc.ts
- desktop/src/main/index.ts
- desktop/src/preload/index.ts
- desktop/src/renderer/src/components/results/Renderers.tsx
- desktop/src/main/jsonl-client.ts
- desktop/src/renderer/src/components/controls/index.tsx
- desktop/src/renderer/src/components/results/Cards.tsx
- desktop/src/renderer/src/views/Dashboard.tsx
🛑 Comments failed to post (8)
.github/workflows/security-audit.yml (1)
21-25: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Limit
continue-on-errorto the audit step.With this job-level setting, failures in checkout, Python setup, or
pip install -e .are reported as successful, so the workflow can provide false assurance without performing an audit. Keep vulnerability findings non-blocking by movingcontinue-on-error: trueto theauditstep instead.Suggested fix
audit: name: pip-audit runs-on: ubuntu-latest timeout-minutes: 15 - continue-on-error: true steps: @@ - name: audit + continue-on-error: true run: pip-audit --desc🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security-audit.yml around lines 21 - 25, Move continue-on-error: true from the job definition to the pip-audit audit step in the security workflow. Keep setup steps such as checkout, Python configuration, and dependency installation blocking on failure, while allowing only vulnerability findings from the audit command to be non-blocking..vouch/captures/ec4b8842-f167-467e-a33c-dc87911c9e0e.jsonl (1)
1-36: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not commit raw shell-history captures with host metadata.
This record exposes absolute local paths, GitHub account activity, branch/remotes, and mutating commands such as
gh pr merge. Redact or normalize session captures before committing; retain only derived project facts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.vouch/captures/ec4b8842-f167-467e-a33c-dc87911c9e0e.jsonl around lines 1 - 36, Remove the raw shell-history capture containing host paths, account activity, repository details, and mutating commands; do not commit this session record. Replace it with a sanitized, normalized artifact containing only derived project facts, or redact sensitive metadata and command history before committing..vouch/decided/20260707-092531-154cb163.yaml (1)
41-45: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Record a meaningful rejection reason.
status: rejectedwithdecision_reason: 'yes'is semantically invalid and leaves consumers unable to explain the decision. Store the actual rationale, or usenullonly if the schema explicitly permits an absent reason.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.vouch/decided/20260707-092531-154cb163.yaml around lines 41 - 45, Replace the placeholder decision_reason value "yes" with the actual rationale for the rejected decision, preserving the existing schema and YAML structure; use null only if the schema explicitly allows an absent reason..vouch/decided/20260707-093005-05345f47.yaml (1)
19-21: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact machine-local paths before approving this record.
The durable session summary includes private filesystem locations under
/home/a/.claudeand/tmp/claude-1000. These paths are not portable and expose local environment metadata; normalize them to repository-relative references or omit them.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.vouch/decided/20260707-093005-05345f47.yaml around lines 19 - 21, Redact the machine-local filesystem paths in the durable session summary, including entries under /home/a/.claude and /tmp/claude-1000. Replace them with repository-relative references where applicable, or remove them if no portable equivalent exists..vouch/pages/session-what-are-the-non-development-related-files-and-folde.md (1)
36-38: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact machine-specific paths before committing session records.
This page persists
/home/a/...and/tmp/...paths, exposing local usernames, workspace locations, and scratchpad details in repository history. Normalize these paths to placeholders or omit them before generating the committed record.Also applies to: 71-72
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.vouch/pages/session-what-are-the-non-development-related-files-and-folde.md around lines 36 - 38, Remove or sanitize the machine-specific `/home/a/...` and `/tmp/...` entries in the session-record page, including the corresponding entries at the additionally referenced section, replacing them with generic placeholders or omitting them before committing.CONTRIBUTING.md (1)
128-130: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use evidence appropriate to the changed interface.
This requirement applies to CLI and other user-facing changes but only accepts a vouch-ui recording, which cannot demonstrate CLI output or hook behavior. Require webapp screenshots for webapp changes, and terminal transcripts or equivalent evidence for CLI changes.
As per coding guidelines, this section defines required PR contents for webapp, CLI-output, and user-facing behavior changes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTING.md` around lines 128 - 130, Update the contribution requirements to require evidence appropriate to the changed interface: request vouch-ui screenshots or screen recordings for webapp changes, and terminal transcripts or equivalent evidence for CLI output, hooks, or other non-webapp user-facing behavior.Source: Coding guidelines
docs/superpowers/specs/2026-07-06-review-ui-multi-kb-design.md (1)
4-9: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Make the shipped reference reproducible.
SHIPPEDcurrently points to~/Dev/plind-junior/vouch-uiand an unpushed branch, so readers cannot resolve the exact implementation. Record an immutable commit or release reference, and mark the local branch as reference-only.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/specs/2026-07-06-review-ui-multi-kb-design.md` around lines 4 - 9, Update the status note to reference an immutable commit SHA or release tag for the shipped implementation instead of the local vouch-ui path alone, and explicitly label the unpushed feat/review-ui-multi-kb branch as reference-only.src/vouch/server.py (1)
853-864: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== Relevant tool definitions ==\n' rg -n "def kb_reindex_embeddings|def _h_reindex_embeddings|backfill_embeddings\(" src/vouch/server.py src/vouch/jsonl_server.py src/vouch/capabilities.py src/vouch/cli.py printf '\n== Surrounding context in src/vouch/server.py ==\n' sed -n '840,880p' src/vouch/server.py printf '\n== Surrounding context in src/vouch/jsonl_server.py ==\n' sed -n '1,260p' src/vouch/jsonl_server.py printf '\n== Surrounding context in src/vouch/cli.py ==\n' sed -n '1,260p' src/vouch/cli.pyRepository: vouchdev/vouch
Length of output: 1951
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '\n== Locate the JSONL mirror and tool registration ==\n' rg -n "_h_reindex_embeddings|kb_reindex_embeddings|reindex_embeddings" src/vouch printf '\n== Show only the relevant slices if found ==\n' for f in src/vouch/server.py src/vouch/jsonl_server.py src/vouch/cli.py src/vouch/capabilities.py; do if rg -q "reindex_embeddings" "$f"; then echo "--- $f ---" sed -n '840,880p' "$f" 2>/dev/null || true sed -n '1,220p' "$f" 2>/dev/null || true fi doneRepository: vouchdev/vouch
Length of output: 1951
Remove or wire the unused
backfillflag.kb_reindex_embeddingsacceptsbackfillbut always callsbackfill_embeddings(store, force=force), so the parameter is a misleading no-op.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/vouch/server.py` around lines 853 - 864, Remove the unused backfill parameter from kb_reindex_embeddings and update its callers or, if the flag is required by the API, pass it through to backfill_embeddings so it changes behavior. Ensure the function signature, invocation, and related documentation consistently reflect the chosen behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Fixes #425
Problem
The per-prompt KB-context hook (vouch context-hook, wired to claude-code's UserPromptSubmit) computed retrieval via build_context_pack but never fed the entity-salience reflex (#223) — salience.record_query was never called from the hook path, leaving the reflex permanently dormant for every claude-code session, even though compute_salience/attach_salience were fully implemented and working.
Fix
claude-code: build_claude_prompt_hook now calls salience.record_query when a session_id is present, wrapped so a salience failure can never break the hook's existing "never raises, never blocks the turn" contract.
codex: exposes UserPromptSubmit with the same {prompt, session_id, ...} payload and additionalContext response shape as claude-code, so the existing context-hook command now serves both hosts unmodified. Wired via a new hooks.json entry alongside the existing Stop (session capture) hook.
openclaw: no changes needed. Its context-engine slot (src/vouch/openclaw/context_engine.py) already calls record_query/attach_salience correctly on every assemble() — a separate, already-correct path from the one this PR fixes. Documented this explicitly in adapters/openclaw/install.yaml rather than leaving it unaddressed.
cursor: not wired. beforeSubmitPrompt is validation/block-only and cannot inject additionalContext — confirmed against Cursor's own docs, and there's an open, unresolved Cursor feature request asking for exactly this capability. Documented in adapters/cursor/install.yaml, per #425's own "explicitly tiered out if a host lacks the event" allowance.
Note: rather than adding a new auto-context command as literally described, this reuses the existing context-hook command for both hosts — it already does exactly what's needed, and duplicating it would've added unreviewable redundancy for no behavioral difference.
Testing
Added 3 regression tests in tests/test_hooks.py: salience recording actually happens with a session_id, is skipped safely without one, and a recording failure doesn't break the hook's real output
Added 2 tests in tests/test_install_adapter.py: codex's UserPromptSubmit hook installs correctly and doesn't duplicate on reinstall
Confirmed OpenClaw's existing 23 context-engine tests pass unchanged
Full suite: ruff check / mypy clean, pytest 121/121 relevant tests passing (full run: 1165/1166, the one failure is a pre-existing local GPG-agent environment issue unrelated to this change)
CHANGELOG.md updated under [Unreleased]
Summary by CodeRabbit
New Features
Bug Fixes
Chores