feat: ingest DiskSage metadata catalog batches - #59
Conversation
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
b05da1b to
013a69d
Compare
013a69d to
e87b0c0
Compare
|
@opencode-agent review Please perform an independent formal review of exact head |
|
@opencode-agent review Please perform an independent formal review of exact current head |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='113d7c434ecc82ec1c9f95060d587deb1b1b4bcd'
requested_base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
echo '== checked-out HEAD =='
git rev-parse HEAD
echo '== requested commits =='
git cat-file -t "$requested_head"
git cat-file -t "$requested_base"
echo '== ancestry and merge-base =='
git merge-base "$requested_base" "$requested_head"
git merge-base --is-ancestor "$requested_base" "$requested_head" && echo 'base-is-ancestor=yes'
echo '== changed files =='
git diff --name-status "$requested_base" "$requested_head"
echo '== diff stat =='
git diff --stat "$requested_base" "$requested_head"Length of output: 1818 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='113d7c434ecc82ec1c9f95060d587deb1b1b4bcd'
echo '== adapter outline =='
ast-grep outline src/sdp/disksage_catalog.py --items all --view expanded
echo '== API outline: DiskSage candidates =='
ast-grep outline src/sdp/api.py --items all --match 'disksage|catalog|graph' --view expanded || true
echo '== test outline =='
ast-grep outline tests/test_disksage_catalog.py --items all --view expanded
echo '== adapter diff =='
git diff --unified=80 "$base" "$head" -- src/sdp/disksage_catalog.py
echo '== API diff =='
git diff --unified=50 "$base" "$head" -- src/sdp/api.py
echo '== test diff =='
git diff --unified=40 "$base" "$head" -- tests/test_disksage_catalog.py
echo '== declared dependency diffs =='
git diff --unified=8 "$base" "$head" -- pyproject.toml requirements-dev.txt requirements-test.in requirements-test.txt requirements.txtLength of output: 61208 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== exact relevant source lines =='
nl -ba src/sdp/disksage_catalog.py | sed -n '38,70p;120,220p;230,315p'
nl -ba src/sdp/api.py | sed -n '685,765p'
echo '== graph store maps =='
fd -t f 'graph_store|authz|policy' src/sdp -x sh -c '
echo "----- $1 -----"
ast-grep outline "$1" --items all --view expanded
' sh {}
echo '== graph upsert implementations and policy evaluation =='
rg -n -A28 -B8 --glob '*.py' \
'def upsert_node\(|def upsert_edge\(|def evaluate\(|def _authorize_graph_write\(' src/sdp
echo '== DiskSage references and privacy-related tests =='
rg -n -A8 -B4 --glob '*.py' \
'disksage|_contains_local_path|_LOCAL_PATH_RE|file:///|/home/|/etc/|/tmp/' src tests
echo '== documentation and dependency declarations =='
git diff --unified=30 e48aa13c4af7a4875d4b53e6a60b50405c265a2f 113d7c434ecc82ec1c9f95060d587deb1b1b4bcd -- README.md docs/implementation-compliance.md
printf '\n-- cryptography pins --\n'
rg -n -A3 -B2 '^cryptography|^PyJWT' pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 1475 🏁 Script executed: #!/bin/bash
set -euo pipefail
numbered_slice() {
file="$1"
range="$2"
sed -n "${range}=" "$file" | paste -d' ' - <(sed -n "${range}p" "$file")
}
echo '== exact relevant source lines =='
numbered_slice src/sdp/disksage_catalog.py '38,70p'
numbered_slice src/sdp/disksage_catalog.py '120,220p'
numbered_slice src/sdp/disksage_catalog.py '230,315p'
numbered_slice src/sdp/api.py '685,765p'
echo '== candidate graph, authorization, and policy files =='
fd -t f . src/sdp | rg '/(graph_store|authz|policy)(\.py|/)'
echo '== graph upsert implementations and policy evaluation =='
rg -n -A28 -B8 --glob '*.py' \
'def upsert_node\(|def upsert_edge\(|def evaluate\(|def _authorize_graph_write\(' src/sdp
echo '== DiskSage references and privacy-related tests =='
rg -n -A8 -B4 --glob '*.py' \
'disksage|_contains_local_path|_LOCAL_PATH_RE|file:///|/home/|/etc/|/tmp/' src tests
echo '== documentation delta =='
git diff --unified=30 e48aa13c4af7a4875d4b53e6a60b50405c265a2f 113d7c434ecc82ec1c9f95060d587deb1b1b4bcd -- README.md docs/implementation-compliance.md
echo '== cryptography and PyJWT pins =='
rg -n -A3 -B2 '^cryptography|^PyJWT' \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 1754 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== DiskSage validator and ingestion =='
sed -n '38,315p' src/sdp/disksage_catalog.py
echo '== graph write authorization and DiskSage endpoint =='
sed -n '685,765p' src/sdp/api.py
echo '== graph store, authorization, and policy definitions =='
rg -n -A36 -B10 --glob '*.py' \
'def upsert_node\(|def upsert_edge\(|def evaluate\(|def _authorize_graph_write\(' src/sdp
echo '== DiskSage privacy tests and references =='
rg -n -A10 -B5 --glob '*.py' \
'disksage|_contains_local_path|_LOCAL_PATH_RE|file:///|/home/|/etc/|/tmp/' src tests
echo '== DiskSage documentation changes =='
git diff --unified=25 e48aa13c4af7a4875d4b53e6a60b50405c265a2f 113d7c434ecc82ec1c9f95060d587deb1b1b4bcd -- README.md docs/implementation-compliance.md
echo '== lock/declaration consistency =='
rg -n -A3 -B2 '^cryptography|^PyJWT' \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 63588
Formal result: not qualified. Blocking finding: generic POSIX absolute paths remain accepted
For example, this valid schema field passes validation: {
"content_context": ["source=/etc/sdp/secret.json"]
}
The candidate validator at Line 130 therefore accepts the request. The ingestion path then persists Update the detector to reject any absolute POSIX path token, not only selected home and macOS prefixes. Add regression tests for at least The requested privacy repair is otherwise present. The implementation rejects I also verified these items:
You are interacting with an AI system. |
|
@coderabbitai review Please perform an independent formal review of exact current head |
Rate Limit Exceeded
|
CodeRabbit flagged that DiskSage catalog validation only blocked a selected prefix list. Generic absolute paths such as /etc and /tmp could still persist in graph properties. Reject any absolute POSIX token and add regressions for those cases. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
Pushed
|
|
@coderabbitai review Please review exact current head |
|
@coderabbitai review Please perform an independent formal review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='82db4f7571bffcbeb08fcdc5a9b77b5e79384b8f'
echo '== Repository and commit identity =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$base"
git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== DiskSage adapter outline =='
ast-grep outline src/sdp/disksage_catalog.py --items all --view expanded
echo '== Adapter and test diffs =='
git diff --unified=80 "$base" "$head" -- src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== API diff and endpoint context =='
git diff --unified=50 "$base" "$head" -- src/sdp/api.py
rg -n -A45 -B20 --glob '*.py' 'disksage|_authorize_graph_write\(' src/sdp/api.py
echo '== Graph upsert and authorization implementations =='
rg -n -A36 -B10 --glob '*.py' \
'def upsert_node\(|def upsert_edge\(|def evaluate\(|def _authorize_graph_write\(' src/sdp
echo '== DiskSage tests and privacy patterns =='
rg -n -A18 -B8 --glob '*.py' \
'_LOCAL_PATH_RE|_contains_local_path|file:///|/home/|/etc/|/tmp/|https://' \
src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== Dependency declaration and lock diffs =='
git diff --unified=12 "$base" "$head" -- \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 101647 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='82db4f7571bffcbeb08fcdc5a9b77b5e79384b8f'
echo '== Role resolution and authentication surfaces =='
fd -t f . src/sdp | rg '/(authz|policy|api)(\.py|/)'
rg -n -A35 -B8 --glob '*.py' \
'def has_role\(|def _is_admin\(|def authenticate|Authorization|Bearer|actor:|subject=' \
src/sdp
echo '== Comparable mutation endpoint authorization =='
rg -n -A20 -B8 --glob '*.py' \
'`@app`\.(post|patch|put|delete)\(|_authorize_graph_write\(|evaluate\(subject=.*action="(create|publish|patch|deprecate)"' \
src/sdp/api.py
echo '== Full DiskSage documentation delta =='
git diff --unified=70 "$base" "$head" -- README.md docs/implementation-compliance.md
echo '== Direct dependency pins in manifests and lock package headers =='
for f in pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt; do
echo "----- $f -----"
rg -n -A2 -B2 '^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)==|^cryptography==' "$f" || true
done
echo '== Additional path-boundary test coverage =='
rg -n -A10 -B5 --glob '*.py' \
'path-bearing|local.path|absolute.path|file.uri|relative_path|content_context|metadata_evidence' \
tests src/sdp/disksage_catalog.py
echo '== Exact source line locations for the candidate finding =='
nl -ba src/sdp/disksage_catalog.py | sed -n '44,70p;136,178p;240,315p'Length of output: 117325
Formal result: not qualified. Blocking finding 1: The path-free boundary still accepts punctuation-delimited POSIX paths
This accepted value contains a local absolute path: {
"content_context": ["recording (/etc/sdp/secret.json)"]
}The character before The Reject absolute POSIX paths after other token delimiters such as Blocking finding 2: The ingestion RBAC guard trusts a caller-controlled
|
|
@opencode-agent review Please perform an independent formal review of exact current head |
CodeRabbit found that /etc and /tmp still persisted when wrapped in
parentheses or other punctuation, because the detector only looked
after start, whitespace, =, or :. Treat (, [, {, quotes, and commas
as delimiters and add endpoint regressions. HTTPS context stays valid.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='b74cf33dbfc8dde87c3f79351528313e2ca2978b'
echo '== Commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== DiskSage adapter outline =='
ast-grep outline src/sdp/disksage_catalog.py --items all --view expanded
echo '== DiskSage adapter and test diff =='
git diff --unified=100 "$base" "$head" -- \
src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== Endpoint and authorization context =='
rg -n -A55 -B20 --glob '*.py' \
'disksage|DiskSageCatalogRequest|_authorize_graph_write\(|def has_role\(|def evaluate\(' \
src/sdp/api.py src/sdp/authz.py
echo '== Graph identity and upsert implementations =='
rg -n -A40 -B10 --glob '*.py' \
'def (canonical|candidate|batch).*id|def upsert_node\(|def upsert_edge\(|cataloged_in' \
src/sdp
echo '== Privacy tests and exact source locations =='
rg -n -A24 -B8 --glob '*.py' \
'_LOCAL_PATH_RE|_contains_local_path|file:///|/etc/|/tmp/|recording \(|https://' \
src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== Documentation and dependency consistency =='
git diff --unified=40 "$base" "$head" -- README.md docs/implementation-compliance.md \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt
rg -n -A3 -B2 '^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)==|^cryptography==' \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 135326 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== API middleware and authentication routes =='
sed -n '105,175p' src/sdp/api.py
rg -n -A60 -B15 --glob '*.py' \
'oidc|verify.*token|Authorization|HTTPBearer|OAuth2|authenticate|resolve_oidc_actor_context' \
src/sdp
echo '== Request models that supply graph authorization subjects =='
rg -n -A20 -B8 --glob '*.py' \
'class (DiskSageCatalogRequest|GraphNodeRequest|GraphEdgeRequest|OntologyConceptRequest)|actor:' \
src/sdp/domain.py src/sdp/disksage_catalog.py src/sdp/api.py
echo '== Policy decision implementation and built-in subjects =='
rg -n -A70 -B12 --glob '*.py' \
'def evaluate\(|_SUBJECTS\s*=|ActorContext\(subject="admin"|action == "create"|action.*create' \
src/sdp/policy.py src/sdp/authz.py
echo '== Delimiter-boundary coverage and detector expression =='
nl -ba src/sdp/disksage_catalog.py | sed -n '44,72p;136,146p;210,216p'
nl -ba tests/test_disksage_catalog.py | sed -n '95,220p'Length of output: 47582
Formal result: not qualified. Blocking finding 1: The path-free boundary still accepts absolute paths after unlisted delimiters
_PATH_TOKEN_PREFIX = r"(?:^|[\s=:({\[\"',])"The new tests correctly cover {
"content_context": ["recording;/etc/sdp/secret.json"]
}The preceding character is The same bypass applies after other unlisted delimiters, such as Reject absolute local paths independently of a fixed prefix delimiter list, or define a complete token-boundary rule. Add endpoint regressions for at least: Blocking finding 2: The DiskSage endpoint does not bind
|
CodeRabbit showed that a fixed prefix class still accepted recording;/etc/... and recording|/tmp/.... Strip http(s) URLs first, then reject any absolute POSIX token after a non-alphanumeric boundary so new punctuation cannot reopen the leak. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
@coderabbitai review Please perform an independent formal review of exact current head Path-free boundary: The request-body Anchor every finding and any formal result only to this SHA. |
|
@opencode-agent review Please perform an independent formal review of exact current head |
|
@opencode-agent review Please perform an independent formal review of exact current head |
|
@coderabbitai review Please perform an independent formal review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='b74cf33dbfc8dde87c3f79351528313e2ca2978b'
echo '== commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== changed files =='
git diff --name-status "$base" "$head"
echo '== DiskSage adapter outline =='
ast-grep outline src/sdp/disksage_catalog.py --items all --view expanded
echo '== adapter and test diff =='
git diff --unified=100 "$base" "$head" -- \
src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== endpoint and authorization context =='
rg -n -A55 -B20 --glob '*.py' \
'disksage|DiskSageCatalogRequest|_authorize_graph_write\(|def has_role\(|def evaluate\(' \
src/sdp/api.py src/sdp/authz.py src/sdp/policy.py
echo '== graph identity and upsert implementations =='
rg -n -A40 -B10 --glob '*.py' \
'def (canonical|candidate|batch).*id|def upsert_node\(|def upsert_edge\(|cataloged_in' \
src/sdp
echo '== privacy patterns and tests =='
rg -n -A24 -B8 --glob '*.py' \
'_LOCAL_PATH_RE|_contains_local_path|file:///|/etc/|/tmp/|recording \(|https://' \
src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== dependency declarations and locks =='
git diff --unified=30 "$base" "$head" -- \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt
rg -n -A3 -B2 '^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)==|^cryptography==' \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 125362
Formal result: not qualified. Blocking finding: The exact b74 path detector still has an incomplete delimiter list
_PATH_TOKEN_PREFIX = r"(?:^|[\s=:({\[\"',])"The detector rejects the requested parenthesis, bracket, brace, quote, and comma cases. The tests cover these forms. However, it does not reject local paths after delimiters outside that class. These accepted values contain absolute local paths: {
"content_context": [
"recording;/etc/sdp/secret.json",
"recording|/tmp/disksage-preview.m4a"
]
}
Reject absolute POSIX paths without a fixed delimiter allowlist. Add endpoint regressions for semicolon and pipe delimiters. Verified items
The sandbox worktree was checked out at successor commit Thanks for clarifying that ✏️ Learnings added
You are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='75f4aed526af57e114228f8c03463bdcd36596a5'
echo '== Commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== DiskSage adapter outline =='
ast-grep outline src/sdp/disksage_catalog.py --items all --view expanded
echo '== Adapter and test changes =='
git diff --unified=100 "$base" "$head" -- \
src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== Endpoint and authorization context =='
rg -n -A55 -B20 --glob '*.py' \
'disksage|DiskSageCatalogRequest|_authorize_graph_write\(|def has_role\(|def evaluate\(' \
src/sdp/api.py src/sdp/authz.py src/sdp/policy.py
echo '== Graph identity and upsert context =='
rg -n -A42 -B12 --glob '*.py' \
'def (canonical|candidate|batch).*id|def upsert_node\(|def upsert_edge\(|cataloged_in' \
src/sdp
echo '== Exact privacy detector and tests =='
nl -ba src/sdp/disksage_catalog.py | sed -n '35,85p;120,185p;200,320p'
nl -ba tests/test_disksage_catalog.py | sed -n '1,280p'
echo '== Documentation and dependency consistency =='
git diff --unified=45 "$base" "$head" -- \
README.md docs/implementation-compliance.md pyproject.toml requirements.txt \
requirements-dev.txt requirements-test.in requirements-test.txt
rg -n -A3 -B2 '^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)==|^cryptography==' \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txtLength of output: 65094 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='75f4aed526af57e114228f8c03463bdcd36596a5'
echo '== API change =='
git diff --unified=70 "$base" "$head" -- src/sdp/api.py
echo '== Remainder of DiskSage tests =='
sed -n '200,300p' tests/test_disksage_catalog.py
echo '== All DiskSage path test assertions =='
rg -n -A8 -B4 --glob '*.py' \
'_contains_local_path\(|file:|https?://|/[A-Za-z]|\\\\|relative_path|path-bearing' \
tests/test_disksage_catalog.py src/sdp/disksage_catalog.py
echo '== Request model and graph-write contract comparison =='
rg -n -A24 -B8 --glob '*.py' \
'class (GraphNodeRequest|GraphEdgeRequest|OntologyConceptRequest)|actor:|def ingest_(graph_node|graph_edge|disksage_catalog)' \
src/sdp/domain.py src/sdp/disksage_catalog.py src/sdp/api.py
echo '== DiskSage documentation =='
git diff --unified=80 "$base" "$head" -- README.md docs/implementation-compliance.md
echo '== Dependency changes and declared pins =='
git diff --unified=30 "$base" "$head" -- \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt
for f in pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt; do
echo "----- $f -----"
grep -nE '^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)(\[.*\])?([=<>!~].*)?$|^cryptography==' "$f" || true
done
echo '== Graph node and edge constraints =='
rg -n -A22 -B8 --glob '*.py' \
'CREATE TABLE.*graph_(nodes|edges)|UNIQUE|PRIMARY KEY|ON CONFLICT \(node_id\)|ON CONFLICT \(edge_type, source_id, target_id\)' \
src/sdp/graph_store.pyLength of output: 94659
Formal result: not qualified. Blocking finding: The path-free boundary accepts the POSIX root path
_ABSOLUTE_POSIX_RE = re.compile(r"(?<![A-Za-z0-9])/[^/\s]")The expression requires one non-slash, non-whitespace character after These values pass {
"content_context": ["/"]
}{
"content_context": ["source=/ "]
}
Reject Verified items
The request-body I used static inspection only. I did not execute repository code or tests. You are interacting with an AI system. |
CodeRabbit showed that `/` and `source=/ ` still passed the path-free detector because it required a non-slash character after `/`. Treat a trailing or whitespace-followed root as an absolute POSIX token. HTTPS context remains accepted. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
@coderabbitai review Please perform an independent formal review of exact current head Path-free boundary: The request-body Anchor every finding and any formal result only to this SHA. |
|
@opencode-agent review Please perform an independent formal review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='65e4fd770c69192daafe51854eb73eb2f06f0bf4'
echo '== exact identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== changed paths =='
git diff --name-status "$base" "$head"
echo '== DiskSage adapter outline at requested head =='
git show "$head:src/sdp/disksage_catalog.py" > /tmp/disksage_catalog.py
ast-grep outline /tmp/disksage_catalog.py --items all --view expanded
echo '== exact adapter and test diff =='
git diff --unified=100 "$base" "$head" -- src/sdp/disksage_catalog.py tests/test_disksage_catalog.py
echo '== exact API diff and DiskSage endpoint context =='
git diff --unified=70 "$base" "$head" -- src/sdp/api.py
git show "$head:src/sdp/api.py" | rg -n -A60 -B20 'disksage|DiskSageCatalogRequest|_authorize_graph_write\('
echo '== detector, validators, and ingestion at requested head =='
git show "$head:src/sdp/disksage_catalog.py" | nl -ba | sed -n '35,335p'
echo '== all privacy tests at requested head =='
git show "$head:tests/test_disksage_catalog.py" | nl -ba | sed -n '1,340p'
echo '== identity/upsert implementations at requested head =='
for f in src/sdp/disksage_catalog.py src/sdp/graph_store.py; do
echo "----- $f -----"
git show "$head:$f" | rg -n -A45 -B12 \
'def (canonical|candidate|batch).*id|def upsert_node\(|def upsert_edge\(|cataloged_in|ON CONFLICT|PRIMARY KEY|UNIQUE' || true
done
echo '== exact dependency declaration and lock changes =='
git diff --unified=35 "$base" "$head" -- \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt
for f in pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt; do
echo "----- $f at requested head -----"
git show "$head:$f" 2>/dev/null | rg -n -A3 -B2 \
'^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)(\[.*\])?([=<>!~].*)?$|^cryptography==' || true
doneLength of output: 47590 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='65e4fd770c69192daafe51854eb73eb2f06f0bf4'
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
show_range() {
file="$1"
start="$2"
end="$3"
echo "----- $file lines $start-$end at requested head -----"
git show "$head:$file" | sed -n "${start},${end}p" | awk -v n="$start" '{printf "%d %s\n", n++, $0}'
}
show_range src/sdp/disksage_catalog.py 35 335
show_range tests/test_disksage_catalog.py 1 280
echo '== graph-store file candidates =='
git ls-tree -r --name-only "$head" src/sdp | rg '(^|/)(graph_store|authz|policy)\.py$'
echo '== graph identity, upsert, and constraints =='
for f in src/sdp/graph_store.py src/sdp/authz.py src/sdp/policy.py; do
echo "----- $f -----"
git show "$head:$f" | rg -n -A55 -B15 \
'def upsert_node\(|def upsert_edge\(|def evaluate\(|def has_role\(|ON CONFLICT|PRIMARY KEY|UNIQUE|_SUBJECTS' || true
done
echo '== URL-pattern and path detector probes using static Python regex semantics =='
python3 - <<'PY'
import re
url = re.compile(r"[a-zA-Z][a-zA-Z0-9+.-]*://[^/\s]+(?:/[A-Za-z0-9._~%+-]*)*", re.I)
posix = re.compile(r"(?<![A-Za-z0-9])/(?:[^/\s]|\s|$)")
homewin = re.compile(r"(?:~/|[A-Za-z]:[\\/]|\\\\)")
cases = [
"docs=https://example.com/disksage/catalog",
"docs=https://example.com/a?next=/etc/sdp/secret.json",
"docs=https://example.com/a#anchor",
"docs=https://example.com/a%2Fb",
"source=/",
"source=/ ",
"recording;/etc/sdp/secret.json",
"recording|/tmp/disksage-preview.m4a",
]
for value in cases:
stripped = url.sub(" ", value)
print(repr(value), "=>", repr(stripped),
"posix=", bool(posix.search(stripped)),
"homewin=", bool(homewin.search(stripped)))
PY
echo '== exact documentation and dependency changes =='
git diff --unified=50 "$base" "$head" -- README.md docs/implementation-compliance.md \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt
echo '== dependency pins at requested head =='
for f in pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt; do
echo "----- $f -----"
git show "$head:$f" 2>/dev/null | rg -n -A4 -B3 \
'^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)(\[.*\])?([=<>!~].*)?$|^cryptography==' || true
doneLength of output: 114182
Formal result: qualified. I found no blocking PR-scoped issue by static inspection. Verified items:
I used the existing shared graph-write I did not execute repository code or tests in this environment. 🧠 Learnings usedYou are interacting with an AI system. |
|
@coderabbitai review Please perform an independent formal review of exact current head The path-free detector now rejects any absolute POSIX token after a non-alphanumeric boundary, including |
|
@opencode-agent review Please perform an independent formal review of exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e48aa13c4af7a4875d4b53e6a60b50405c265a2f'
head='65e4fd770c69192daafe51854eb73eb2f06f0bf4'
echo '== Commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== DiskSage adapter outline at requested head =='
git show "$head:src/sdp/disksage_catalog.py" > /tmp/disksage_catalog.py
ast-grep outline /tmp/disksage_catalog.py --items all --view expanded
echo '== Adapter, endpoint, and test diffs =='
git diff --unified=90 "$base" "$head" -- \
src/sdp/disksage_catalog.py src/sdp/api.py tests/test_disksage_catalog.py
echo '== Exact path detector, schema, lineage, and ingestion =='
git show "$head:src/sdp/disksage_catalog.py" | nl -ba | sed -n '35,345p'
echo '== Exact DiskSage endpoint and graph-write authorization =='
git show "$head:src/sdp/api.py" | nl -ba | \
rg -n -A70 -B25 'disksage|DiskSageCatalogRequest|_authorize_graph_write\('
echo '== Exact tests =='
git show "$head:tests/test_disksage_catalog.py" | nl -ba | sed -n '1,360p'
echo '== Graph identities, upserts, and policy definitions =='
for f in src/sdp/disksage_catalog.py src/sdp/graph_store.py src/sdp/authz.py src/sdp/policy.py; do
echo "----- $f -----"
git show "$head:$f" | rg -n -A55 -B15 \
'def (canonical|candidate|batch).*id|def upsert_node\(|def upsert_edge\(|cataloged_in|def evaluate\(|def has_role\(|ON CONFLICT|PRIMARY KEY|UNIQUE' || true
done
echo '== Dependency changes and exact pins =='
git diff --unified=35 "$base" "$head" -- \
pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt
for f in pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt; do
echo "----- $f -----"
git show "$head:$f" 2>/dev/null | rg -n -A3 -B2 \
'^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)(\[.*\])?([=<>!~].*)?$|^cryptography==' || true
doneLength of output: 40863 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='65e4fd770c69192daafe51854eb73eb2f06f0bf4'
show_range() {
file="$1"
start="$2"
end="$3"
echo "----- $file:$start-$end at $head -----"
git show "$head:$file" | sed -n "${start},${end}p" | awk -v line="$start" '{printf "%d: %s\n", line++, $0}'
}
show_range src/sdp/disksage_catalog.py 45 82
show_range src/sdp/disksage_catalog.py 145 218
show_range src/sdp/disksage_catalog.py 245 334
show_range src/sdp/api.py 690 780
show_range tests/test_disksage_catalog.py 70 227
echo '== Exact graph-store upsert methods and key constraints =='
git show "$head:src/sdp/graph_store.py" | \
rg -n -A55 -B15 'def upsert_node\(|def upsert_edge\(|ON CONFLICT|PRIMARY KEY|UNIQUE|class (Memory|Postgres)'
echo '== Exact graph-write policy and role mapping =='
for f in src/sdp/authz.py src/sdp/policy.py; do
echo "----- $f -----"
git show "$head:$f" | rg -n -A55 -B15 'def evaluate\(|def has_role\(|_SUBJECTS|admin|action == "create"|action="create"'
done
echo '== Exact declared dependency pins =='
for f in pyproject.toml requirements.txt requirements-dev.txt requirements-test.in requirements-test.txt; do
echo "----- $f -----"
git show "$head:$f" | grep -nE '^(cryptography|PyJWT|fastapi|pydantic|psycopg|uvicorn)(\[.*\])?([=<>!~].*)?$|^cryptography==' || true
doneLength of output: 47810
Formal result: qualified. I found no blocking PR-scoped issue by static inspection. Verified items:
The request-body I did not execute repository code or tests in this environment. You are interacting with an AI system. |
|
@opencode-agent review |
opencode-agent
Bot
added
priority: medium
2 participants
Summary
disksage.file-catalog-candidate-batchfile_candidate/catalog_batchgraph nodes andcataloged_inedges; no file or provider mutationEvidence
113d7c434ecc82ec1c9f95060d587deb1b1b4bcdagainstmain@e48aa13c4af7a4875d4b53e6a60b50405c265a2f.PYTHONPATH=src python -m pytest -q-> 293 passed, 8 integration tests skipped without Postgres.ruff check src/sdp/disksage_catalog.py src/sdp/api.py tests/test_disksage_catalog.pypassed on the preceding functional head; the privacy-only successor changes the validator and its regression test.251210_1631.m4aand returned HTTP 200; production source remainedembedded:ffprobe:comment-date.docs/papers/README.md; this change uses the existing property-graph lineage surface.Privacy boundary repair
file:///Users/...and Linux/home/...values passed the original absolute-path detector.Safety