fix: address 2026-09-01 full code review CRITICAL and HIGH findings - #169
Merged
Conversation
Harden streaming UTF-8 decode, action cache isolation, walker lock/finalize semantics, orchestrator turn-scoped prompt cache, graph repair serialization, Facebook/MCP/path-traversal security, memory deferred-save flushing, channel dedup, SSE egress, and CLI destructive-sync guards. Adds regression tests and review doc. Co-authored-by: Cursor <cursoragent@cursor.com>
_first_app_root_path broke on the first subcommand, so ``validate examples/jvagent_app`` defaulted to cwd and CI failed. Restore continue-after-subcommand parsing; add regression test. Co-authored-by: Cursor <cursoragent@cursor.com>
Trailing whitespace, black, and isort on tests and review doc so CI pre-commit hook matches local gate. Co-authored-by: Cursor <cursoragent@cursor.com>
3 tasks
eldonm
added a commit
that referenced
this pull request
Sep 1, 2026
fix: 2026-09-01 code review (#169 + batch 2) for dev integration
3 tasks
eldonm
added a commit
that referenced
this pull request
Sep 1, 2026
revert: undo PR #169 — route code review via dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the 13 CRITICAL and the majority of HIGH/MEDIUM findings from the 2026-09-01 full code review (82 files, +2,327/−295).
Security & correctness
chunking.py) — fixes non-Latin reply corruption (C1){agent_id}:interact:enabledcache key +InteractWalker.spawn()lock/finalize semantics (C2)reattach_ctx, per-node edge scratch paging (C3, C4)ContextVar(turn_cache.py); type-safe_normalize(C5, C6)custom_tools: vault namespacing + delete access checks (C10)jvagent/scaffold/path_safe.py) wired into CLI/scaffold/bundler (C11–C13)Memory, channels, response
get_last_interaction()beforeInteraction.create(); artifact reap order; deferred-save flush(id, type, seq); partial-delivery retry guardTests
Out of scope (follow-ups)
deregister_actioncleanup — tracked on fix: singleton action correctness (Phase 1) #168Test plan
pre-commit run --all-filespytest tests/(full suite green at commit time)Made with Cursor