feat: multi-agent support (Kimi, Copilot, Gemini, Codex, Zed, z.ai) - #17
Conversation
Port version-sentinel from Claude Code-only to six agent platforms. The hook scripts stay the portable core; each platform gets a thin adapter (manifest, hook wiring, commands). - scripts/lib/platform.sh: normalize foreign tool names (Gemini write_file/replace/run_shell_command, VS Code editFiles/createFile/ runTerminalCommand, Codex apply_patch/exec_command) to the canonical Bash/Edit/Write before the existing logic runs; fail-open preserved - detect-manifest-edit.sh: handle Codex apply_patch payloads and Kimi tool_input.path (bug found in live Kimi e2e) - Kimi Code: kimi.plugin.json, platforms/kimi/commands/, kimi-marketplace.json - GitHub Copilot (VS Code): .github/hooks|agents|prompts/, copilot-instructions.md - Gemini CLI: gemini-extension.json, GEMINI.md, commands/*.toml, hooks/gemini-hooks.json + platforms/gemini/setup.sh (Claude rejects Gemini event keys in hooks/hooks.json — verified live — so Gemini hooks activate inside the installed extension copy instead) - OpenAI Codex: .codex-plugin/plugin.json (reuses the Claude-schema hooks/hooks.json; .claude-plugin/marketplace.json doubles as legacy Codex marketplace) - Zed: AGENTS.md + .agents/skills/ + docs/zed.md static-permissions approximation (no hook support upstream) - tests: platform-normalize unit tests, platform-payload e2e fixtures, Kimi path regression; suite 26/26 green - docs: e2e-checklist (live statuses: Kimi verified, Claude partial, rest pending), marketplaces distribution matrix - release-please: extra-files extended so all six manifests bump together
z.ai has no plugin format of its own — ZCode embeds the Claude Code runtime and the GLM Coding Plan runs inside Claude Code, so the Claude plugin works unchanged. Document the platform and the zai-org/zai-coding-plugins marketplace submission path.
|
Warning Review limit reached
Next review available in: 48 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughVersion Sentinel v0.3.0 adds multi-agent manifests and documentation, normalizes tool names across platforms, supports ChangesVersion Sentinel platform expansion
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant AgentTool
participant DetectionScript
participant VersionRecord
participant DependencyOperation
AgentTool->>DetectionScript: submit normalized edit or install payload
DetectionScript->>VersionRecord: check package version record
VersionRecord-->>DetectionScript: check present or absent
DetectionScript-->>AgentTool: allow or BLOCKED result
AgentTool->>VersionRecord: record verified version
AgentTool->>DependencyOperation: retry original operation
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 13
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
CLAUDE.md (1)
7-27: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language identifiers to all newly added fenced blocks.
The affected fences trigger MD040 and should use an appropriate language such as
textorbash.
CLAUDE.md#L7-L27: mark the project-structure fence astext.README.md#L79-L89: mark the platform-layout fence astext.docs/directory-submission.md#L11-L45: mark each form-copy fence astext.docs/e2e-checklist.md#L77-L80: mark the command fence asbashortext.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CLAUDE.md` around lines 7 - 27, Add language identifiers to every affected fenced block: mark the project-structure fence in CLAUDE.md lines 7-27 and the platform-layout fence in README.md lines 79-89 as text; mark each form-copy fence in docs/directory-submission.md lines 11-45 as text; and mark the command fence in docs/e2e-checklist.md lines 77-80 as bash or text.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/version-sentinel/SKILL.md:
- Line 46: Align the audit documentation with the scanner’s actual depth: update
the guidance at .agents/skills/version-sentinel/SKILL.md:46, AGENTS.md:37, and
GEMINI.md:42-44 to state that scripts/check-versions.sh scans manifests only
within four directory levels, or remove the “every/all manifests” claim while
preserving the release-audit instructions.
- Line 3: Update the frontmatter description for the version-sentinel skill to
explicitly include every supported dependency manifest pattern: package.json,
requirements*.txt, constraints*.txt, pyproject.toml, Cargo.toml, .csproj,
.fsproj, and .vbproj. Keep the existing trigger and version-check workflow
description intact while broadening only the manifest coverage.
In @.github/prompts/vs-record.prompt.md:
- Around line 16-20: Update .github/prompts/vs-record.prompt.md lines 16-20 and
commands/vs-record.toml lines 14-32 so intentional-pin reasons are passed as one
quoted fourth argument to vs-record.sh, while preserving the required
“intentional: <reason>” format; revise both the format guidance and examples
consistently.
In `@AGENTS.md`:
- Line 23: Update the audit manifest list in AGENTS.md at lines 23-23 and
.github/copilot-instructions.md at lines 23-23 to include constraints*.txt,
*.fsproj, and *.vbproj, keeping both descriptions identical and consistent with
the scanner’s supported patterns.
In `@commands/vs-record.toml`:
- Around line 8-12: Update the command template in the vs-record configuration
to use the ACP shell-escaped format, wrapping the existing bash invocation and
{{args}} in !{...}. Preserve the script path and verbatim output relay while
ensuring user-controlled arguments cannot escape the intended command.
In `@docs/directory-submission.md`:
- Around line 3-5: Align the multi-agent port version references with the
manifest’s declared v0.3.0: update the note in docs/directory-submission.md
lines 3-5 and the corresponding research/branch description in
docs/marketplaces.md lines 3-5, preserving the surrounding documentation.
In `@docs/e2e-checklist.md`:
- Around line 199-203: Update the `vs-record.sh` command in the e2e checklist to
reference the installed plugin’s absolute script path, or explicitly invoke it
from the plugin checkout while retaining the scratch project as the working
directory. Keep the existing arguments and retry/success verification unchanged.
In `@docs/zed.md`:
- Around line 20-44: Update the Zed settings example under the
agent.tool_permissions documentation to use the current
agent.tool_permissions.tools.<tool> schema, representing each permission rule as
an object with a pattern field inside the appropriate always_confirm array.
Preserve the existing terminal and edit-file patterns, and add patterns covering
.fsproj and .vbproj files alongside .csproj.
In `@GEMINI.md`:
- Line 15: Update the fenced code blocks in GEMINI.md, including the stderr
example and command examples, to specify the appropriate language tags: use text
for stderr and bash for shell commands. Apply the same tags to all referenced
blocks so markdownlint MD040 passes.
In `@platforms/gemini/setup.sh`:
- Around line 18-27: Update the safety guard in setup.sh to require that ROOT
exactly matches the resolved Gemini extension directory, rather than accepting
any path containing ".gemini/extensions/". Preserve the refusal message and exit
behavior for all other paths, including source checkouts nested beneath that
substring.
In `@platforms/kimi/commands/vs-record.md`:
- Line 11: Update the “Ecosystems (v0.1)” marker in the ecosystem support
documentation to reflect the project’s current v0.3.0 synchronization, or remove
the version marker if it is no longer needed; preserve the listed ecosystem
names.
- Around line 16-20: Update the command invocation in vs-record so the script
receives the defined positional arguments without word-splitting: pass $1, "$2",
"$3", and "$4" individually instead of expanding $ARGUMENTS. Preserve the
existing Bash script path and argument order.
In `@scripts/detect-manifest-edit.sh`:
- Around line 49-52: Update the post-content extraction in the manifest
detection logic to select only non-empty content or new_content values, rather
than treating an empty content field as usable. Ensure payloads with content: ""
fall back to a non-empty new_content when available, and otherwise remain
subject to the reconstruction guard instead of fail-opening.
---
Outside diff comments:
In `@CLAUDE.md`:
- Around line 7-27: Add language identifiers to every affected fenced block:
mark the project-structure fence in CLAUDE.md lines 7-27 and the platform-layout
fence in README.md lines 79-89 as text; mark each form-copy fence in
docs/directory-submission.md lines 11-45 as text; and mark the command fence in
docs/e2e-checklist.md lines 77-80 as bash or text.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c133cc02-7c55-457d-b34a-48bb99738927
📒 Files selected for processing (42)
.agents/skills/version-sentinel/SKILL.md.claude-plugin/marketplace.json.codex-plugin/plugin.json.github/agents/version-reviewer.agent.md.github/copilot-instructions.md.github/hooks/version-sentinel.json.github/prompts/check-versions.prompt.md.github/prompts/vs-record.prompt.mdAGENTS.mdCLAUDE.mdGEMINI.mdREADME.mdcommands/check-versions.tomlcommands/vs-record.tomldocs/directory-submission.mddocs/e2e-checklist.mddocs/marketplaces.mddocs/zed.mdgemini-extension.jsonhooks/gemini-hooks.jsonhooks/hooks.jsonkimi-marketplace.jsonkimi.plugin.jsonplatforms/gemini/setup.shplatforms/kimi/commands/check-versions.mdplatforms/kimi/commands/vs-record.mdplugin.jsonrelease-please-config.jsonscripts/auto-record.shscripts/detect-install-cmd.shscripts/detect-manifest-edit.shscripts/lib/platform.shtests/fixtures/edit_input_kimi_path.jsontests/fixtures/payloads/codex-apply-patch-patch-only.jsontests/fixtures/payloads/codex-apply-patch.jsontests/fixtures/payloads/gemini-run-shell-install.jsontests/fixtures/payloads/gemini-write-file.jsontests/fixtures/payloads/kimi-bash-install.jsontests/fixtures/payloads/vscode-editFiles.jsontests/test_detect_manifest_edit.shtests/test_platform_normalize.shtests/test_platform_payloads.sh
| @@ -0,0 +1,46 @@ | |||
| --- | |||
| name: version-sentinel | |||
| description: Use when adding, bumping, or changing a dependency in package.json, requirements.txt, pyproject.toml, Cargo.toml, or a .csproj. Triggered automatically by version-sentinel's PreToolUse hook (where the host supports hooks) — this skill explains how to satisfy the block and record a version check. | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Include every supported manifest in the skill trigger.
The frontmatter only names requirements.txt and .csproj; it omits requirements*.txt, constraints*.txt, .fsproj, and .vbproj. On hookless platforms, the skill may not be selected for those supported dependency changes.
As per coding guidelines, the workflow must cover all supported manifest patterns.
Proposed description update
-description: Use when adding, bumping, or changing a dependency in package.json, requirements.txt, pyproject.toml, Cargo.toml, or a .csproj.
+description: Use when adding, bumping, or changing a dependency in package.json, requirements*.txt, constraints*.txt, pyproject.toml, Cargo.toml, or *.csproj/*.fsproj/*.vbproj.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| description: Use when adding, bumping, or changing a dependency in package.json, requirements.txt, pyproject.toml, Cargo.toml, or a .csproj. Triggered automatically by version-sentinel's PreToolUse hook (where the host supports hooks) — this skill explains how to satisfy the block and record a version check. | |
| description: Use when adding, bumping, or changing a dependency in package.json, requirements*.txt, constraints*.txt, pyproject.toml, Cargo.toml, or *.csproj/*.fsproj/*.vbproj. |
🧰 Tools
🪛 SkillSpector (2.3.11)
[error] 41: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/version-sentinel/SKILL.md at line 3, Update the frontmatter
description for the version-sentinel skill to explicitly include every supported
dependency manifest pattern: package.json, requirements*.txt, constraints*.txt,
pyproject.toml, Cargo.toml, .csproj, .fsproj, and .vbproj. Keep the existing
trigger and version-check workflow description intact while broadening only the
manifest coverage.
Source: Coding guidelines
|
|
||
| ## Audit command | ||
|
|
||
| `bash scripts/check-versions.sh` scans every manifest under the current directory and reports drift. Run it before tagging a release. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Align audit documentation with the scanner’s depth limit.
scripts/check-versions.sh currently uses find . -maxdepth 4, so claims that the audit covers every/all manifests are inaccurate for deeper workspaces.
.agents/skills/version-sentinel/SKILL.md#L46-L46: document the four-level limit or remove it.AGENTS.md#L37-L37: document the four-level limit or remove it.GEMINI.md#L42-L44: document the four-level limit or remove it.
🧰 Tools
🪛 SkillSpector (2.3.11)
[error] 41: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
📍 Affects 3 files
.agents/skills/version-sentinel/SKILL.md#L46-L46(this comment)AGENTS.md#L37-L37GEMINI.md#L42-L44
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/version-sentinel/SKILL.md at line 46, Align the audit
documentation with the scanner’s actual depth: update the guidance at
.agents/skills/version-sentinel/SKILL.md:46, AGENTS.md:37, and GEMINI.md:42-44
to state that scripts/check-versions.sh scans manifests only within four
directory levels, or remove the “every/all manifests” claim while preserving the
release-audit instructions.
| - `/vs-record npm lodash 4.17.21 https://www.npmjs.com/package/lodash` | ||
| - `/vs-record pip requests 2.31.0 https://pypi.org/project/requests/` | ||
| - `/vs-record csproj Serilog 3.1.1 intentional: CVE lock pending audit` | ||
|
|
||
| Use the terminal tool to run `bash scripts/vs-record.sh` with the arguments the user supplied, exactly as given. Relay the script's output verbatim to the user. If the script fails, show its stderr and do not retry with modified arguments unless the user asks. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Pass intentional-pin reasons as one source argument. Both command guides document a space-containing intentional: source as separate shell words, but vs-record.sh expects exactly four arguments.
.github/prompts/vs-record.prompt.md#L16-L20: quote the intentional source or use a space-free reason, and preserve it as the fourth argument when invoking the script.commands/vs-record.toml#L14-L32: apply the same single-argument contract to the format description and examples.
As per coding guidelines, deliberate non-latest pins must be recorded as intentional: <reason>.
📍 Affects 2 files
.github/prompts/vs-record.prompt.md#L16-L20(this comment)commands/vs-record.toml#L14-L32
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/prompts/vs-record.prompt.md around lines 16 - 20, Update
.github/prompts/vs-record.prompt.md lines 16-20 and commands/vs-record.toml
lines 14-32 so intentional-pin reasons are passed as one quoted fourth argument
to vs-record.sh, while preserving the required “intentional: <reason>” format;
revise both the format guidance and examples consistently.
Source: Coding guidelines
| The source must be an `http(s)://` URL you actually consulted, or `intentional:<reason>` for deliberate pins (e.g. CVE lock, compatibility). Example: | ||
|
|
||
| ```bash | ||
| bash scripts/vs-record.sh npm lodash 4.17.21 https://www.npmjs.com/package/lodash |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Keep supported-manifest documentation consistent.
The scanner supports constraints*.txt, *.fsproj, and *.vbproj, but both audit descriptions omit them.
AGENTS.md#L23-L23: update the documented audit manifest list..github/copilot-instructions.md#L23-L23: update the documented audit manifest list.
As per coding guidelines, all supported manifest patterns must be documented consistently.
📍 Affects 2 files
AGENTS.md#L23-L23(this comment).github/copilot-instructions.md#L23-L23
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 23, Update the audit manifest list in AGENTS.md at lines
23-23 and .github/copilot-instructions.md at lines 23-23 to include
constraints*.txt, *.fsproj, and *.vbproj, keeping both descriptions identical
and consistent with the scanner’s supported patterns.
Source: Coding guidelines
| Use the run_shell_command tool to execute exactly: | ||
|
|
||
| bash "${extensionPath}/scripts/vs-record.sh" {{args}} | ||
|
|
||
| Then relay the script's output verbatim to the user. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)(vs-record\.toml|vs-record\.prompt\.md|package\.json|README\.md)$|scripts/vs-record\.sh' || true
echo
echo "== target file =="
if [ -f commands/vs-record.toml ]; then
cat -n commands/vs-record.toml
fi
echo
echo "== related prompt files =="
for f in $(git ls-files | rg 'vs-record\.prompt\.md$|vs-record\.toml$'); do
echo "--- $f"
cat -n "$f"
done
echo
echo "== occurrences of raw args / escaped args in prompt files =="
rg -n '(\{\{args\}\}|!\\{args\\}|!/|! \{args\})' $(git ls-files | rg 'vs-record\.prompt\.md$|vs-record\.toml$') || true
echo
echo "== script summary =="
if [ -f scripts/vs-record.sh ]; then
wc -l scripts/vs-record.sh
sed -n '1,220p' scripts/vs-record.sh | cat -n
fiRepository: KSEGIT/Version-Sentinel
Length of output: 6918
🌐 Web query:
Zed slash commands raw substitution !{} block args command template
💡 Result:
In the Zed editor, the terminology you are asking about does not form a single unified "slash command raw substitution!{} block args" feature, but rather refers to two distinct systems: AI slash commands and project-level task templates. 1. AI Slash Commands and Extensions Slash commands in the AI assistant (invoked by typing /) are primarily used for injecting context (e.g., /file, /terminal, /selection) or invoking custom prompts [1]. When developing extensions for slash commands, the system allows you to define argument completion via the complete_slash_command_argument method [2]. There is no native "raw substitution!{} block" syntax for these; instead, they operate via defined logic in the extension host or the core editor [2][3]. 2. Task Templates (tasks.json) The syntax you likely encountered—which uses variables for substitution—belongs to Zed's Task system [4][5]. - Variables: You can use built-in environment variables (e.g., $ZED_FILE, $ZED_SELECTED_TEXT, $ZED_SYMBOL) in your task command and args arrays [6][7]. Zed automatically performs string substitution on these variables before executing the task [8]. - No Raw Input: Zed's current task system does not support interactive user-provided arguments (e.g., prompting the user for input during execution) [9]. - Syntax: Tasks are defined as JSON objects in tasks.json files [4][5]. While there is no!{} block syntax, users often achieve dynamic behavior by using standard shell features (like read or environment variables) within the command string, or by defining specific tasks with pre-set arguments [4][6][9]. If you saw references to!{} or specific block syntax, it may be related to: - Legacy or experimental features in internal development builds [3]. - Confusion with other editor configuration formats or regex syntax (Zed uses $1, $2 for capture group substitution in regex searches, not!{}) [10]. For managing tasks, use zed: open tasks (global) or zed: open project tasks (local) to create or edit your tasks.json [4][5].
Citations:
- 1: https://zed.dev/docs/ai/text-threads?highlight=std
- 2: https://zedhub.dev/extensions/slash-commands
- 3: https://deepwiki.com/zed-industries/codex-acp/4.2-slash-commands-and-custom-prompts
- 4: https://zed.dev/docs/tasks
- 5: https://github.com/zed-industries/zed/blob/main/docs/src/tasks.md
- 6: https://zed.dev/blog/zed-decoded-tasks
- 7: https://zed.dev/docs/tasks?highlight=hook
- 8: https://github.com/zed-industries/zed/blob/481854f7/crates/task/src/task_template.rs
- 9: Tasks - do they support arg from user input ? zed-industries/zed#10823
- 10: https://github.com/zed-industries/zed/blob/b0911ccc/docs/src/vim.md
🌐 Web query:
Zed extension slash command run_shell_command args raw substitution prompt template
💡 Result:
In Zed, there is no direct or universal slash command named run_shell_command that exposes raw shell execution with arbitrary argument substitution to users or arbitrary extensions [1][2][3]. The functionality related to shell command execution and prompt templates in Zed is handled through distinct mechanisms: 1. Agentic Terminal Tool (run_shell_command): The AI agent in Zed uses a tool internally referred to as run_shell_command [4]. This is a capability granted to the assistant for interacting with the environment, not a user-facing slash command [4][5]. Users interact with this capability by asking the AI to perform tasks, which the agent then executes if it has the necessary permissions (often governed by sandbox settings and tool allowlists) [4][5]. 2. Slash Commands: Custom slash commands for extensions are implemented via the zed_extension_api (using the run_slash_command trait method) [1][6]. These are designed to perform predefined actions or provide context to the AI assistant [1][7]. They do not natively support arbitrary raw shell command execution unless the extension developer explicitly implements that logic within the Rust code of the extension [1][3]. 3. Task System: If your goal is to run shell commands with variable substitution (e.g., using project paths, symbols, or selected text), Zed provides a built-in Tasks system [8][9]. You can define tasks in a.zed/tasks.json file that include shell commands and environment variables [8][9]. These tasks support variable substitution such as $ZED_FILE, $ZED_SYMBOL, and $ZED_SELECTED_TEXT [8]. If you are a developer building an extension, you can grant it the process:exec capability to execute shell commands programmatically using the Zed extension API [10]. However, this is distinct from creating a public-facing slash command and requires defining allowed commands and arguments in the extension's capabilities configuration [10]. Top results: [1], [10], [8], [5], [9]
Citations:
- 1: https://zedhub.dev/extensions/slash-commands
- 2: https://zed.dev/docs/ai/text-threads?highlight=std
- 3: https://github.com/zed-industries/zed/blob/2aa36660/crates/extension_api/wit/since_v0.6.0/extension.wit
- 4: AI: Gemini CLI unable to call shell commands zed-industries/zed#41059
- 5: https://github.com/zed-industries/zed/blob/main/crates/agent/src/templates/system_prompt.hbs
- 6: https://docs.rs/zed_extension_api/latest/x86_64-pc-windows-msvc/zed_extension_api/trait.Extension.html
- 7: The usage of the Slash Command extension zed-industries/zed#17403
- 8: https://zed.dev/blog/zed-decoded-tasks
- 9: https://zed.dev/docs/tasks
- 10: https://zed.dev/docs/extensions/capabilities
🌐 Web query:
github.com/zed-industries/zed tools prompt args shell-escaping
💡 Result:
In the Zed editor, handling shell-escaping for terminal commands and tool prompts has been an area of ongoing development and occasional regression [1][2][3][4]. Zed frequently uses a shell to execute commands (including for Agent Panel terminal tools, MCP/ACP servers, and built-in tasks), which requires careful handling of argument quoting to prevent shell injection or syntax errors [1][2][4][5]. Key technical aspects include: 1. Shell Execution and Quoting: Zed often constructs shell commands by concatenating arguments. Historically, issues have arisen where arguments were not properly escaped, causing shell metacharacters (like $, spaces, or parentheses) to be interpreted by the shell rather than treated as literal values [1][2][3]. 2. Internal Mechanisms: The codebase utilizes utilities such as ShellBuilder and shlex::try_quote to manage argument quoting [1][2]. However, complexities exist where multiple layers of command formation (e.g., in activation scripts or remote execution paths) can lead to redundant or improper quoting [1]. 3. AI Agent Tooling: For the terminal tool used by AI agents, Zed's documentation explicitly warns against using shell substitutions or interpolations (e.g., $VAR, $(...)) in the command input [6]. Users are advised to resolve these values before executing the tool [6]. 4. Configuration Impact: Configuring a custom terminal.shell in settings (e.g., using tmux or non-bash shells) can impact how Zed launches agent servers, as Zed often expects the configured shell to be Bash-compatible for command execution [5]. If you are encountering specific issues with shell escaping (such as unexpected errors with paths containing special characters), it is likely related to how these command strings are being passed through Zed's internal ShellBuilder or terminal integration layers [1][3]. Check the Zed GitHub repository for open issues referencing "shell-escaping" or "quoting" if you suspect a bug [1][2][3].
Citations:
- 1: build_no_quote passes unquoted args to shell, breaking paths with $ characters zed-industries/zed#53046
- 2: AI: ACP terminal seems to not escape provided args when forming sh command line zed-industries/zed#42646
- 3: Go test builtin tasks are not shell-escaping arguments, leading to errors with zsh zed-industries/zed#19226
- 4: Use shell to launch MCP and ACP servers zed-industries/zed#42382
- 5: Zed uses terminal.shell settings outside of the terminal, breaking Codex, Claude, and Gemini ACP Agents zed-industries/zed#46551
- 6: https://github.com/zed-industries/zed/blob/c958a12b/crates/agent/src/tools/terminal_tool.rs
🌐 Web query:
site:github.com/zed-industries/zed run_shell_command prompt args Zed
💡 Result:
In Zed, there is no single "run_shell_command" command that you invoke directly by typing that exact string in the command palette. Instead, shell command execution is handled through Zed's Tasks system and AI integration [1][2]. Here is how you execute shell commands in Zed: Task System (Manual Execution) To run shell commands manually, Zed uses the Tasks system [1]. 1. Open the Command Palette (typically Cmd+Shift+P or Ctrl+Shift+P). 2. Search for and select task: spawn [3][2]. 3. You can select a predefined task or type an ad-hoc ("one-shot") command directly into the input field [2]. 4. Confirm with Cmd+Enter (or Ctrl+Enter) to execute the command [4][2]. 5. The command will run in a new terminal tab (or a reused one) within Zed [1][5][2]. You can use task: rerun to quickly execute the most recent command again [1][2]. AI Integration (Tool Calls) The term run_shell_command often appears in the context of Zed's AI agent logs or configuration [6][7]. This refers to an internal tool used by AI agents (like the Gemini CLI) to execute shell commands on your behalf [6][7]. If you encounter errors related to run_shell_command in AI contexts, it is typically a permission or configuration issue within the external AI tool's settings (e.g., ~/.gemini/settings.json), where the tool must be explicitly allowed to execute shell commands [6][7]. Key Implementation Details: * Task Configuration: You can define persistent tasks in your project's.zed/tasks.json file [8][2]. These can include environment variables, custom shell configurations, and specific working directories [1][3]. * Shell Initialization: Zed launches tasks in a login shell, ensuring your local shell configuration files (such as.bash_profile or.zshrc) are sourced [1][3]. * Terminal Threads: For interactive CLI tools, Zed also supports Terminal Threads, which can be configured to run a specific command automatically upon creation via the agent.terminal_init_command setting [9].
Citations:
- 1: https://github.com/zed-industries/zed/blob/main/docs/src/tasks.md
- 2: Proposal: Tasks in Zed zed-industries/zed#7108
- 3: https://github.com/zed-industries/zed/blob/65e1c5af/docs/src/tasks.md
- 4: Execute shell commands on the command palette zed-industries/zed#7460
- 5: vim
!!opens a new terminal every time zed-industries/zed#25800 - 6: "Tool call not found" frequently occurs in recent versions zed-industries/zed#37653
- 7: AI: Gemini CLI unable to call shell commands zed-industries/zed#41059
- 8: Code runner zed-industries/zed#5141
- 9: https://github.com/zed-industries/zed/blob/main/docs/src/ai/terminal-threads.md
🌐 Web query:
Zed ACP terminal shell_escape_run_command !{} args
💡 Result:
The term shell_escape_run_command does not appear to be a public or documented function in Zed's official API or Agent Client Protocol (ACP) documentation [1][2]. Technical context suggests this likely refers to an internal implementation detail within Zed's codebase, specifically related to how Zed handles the execution of commands requested by ACP-compliant agents [3][4][5]. Key observations from Zed's development include: 1. Handling of Arguments: Zed's internal implementation of terminal command execution has faced challenges regarding the proper escaping of arguments provided by agents [3]. When Zed forms a command line to be executed in a shell (often using an underlying system shell like bash or zsh), it must correctly handle the concatenation of the command and its arguments to prevent shell syntax errors [3][4]. 2. Internal Implementation: The logic for building these commands involves internal utilities, such as task::ShellBuilder, which handles the redirection and construction of commands [4][5]. Developers have identified that simply passing an args array from an ACP event can sometimes lead to shell parsing errors if those arguments are not escaped correctly before being combined into a single shell command string [3]. 3. ACP Terminal Protocol: The Agent Client Protocol specifies events like terminal/create [3]. While the protocol allows for a command and an args array, the editor-side implementation is responsible for safely executing these in the user's terminal environment [3][2]. If you are encountering issues with command execution via ACP in Zed, it is likely an artifact of how the agent's requested command is being processed by the host environment rather than a public function you are expected to call directly [3]. You may be observing internal logs or stack traces related to these escaping efforts [3].
Citations:
- 1: https://zed.dev/docs/ai/external-agents
- 2: https://zed.dev/acp
- 3: AI: ACP terminal seems to not escape provided args when forming sh command line zed-industries/zed#42646
- 4: https://github.com/zed-industries/zed/blob/20a3f770/crates/acp_thread/src/terminal.rs
- 5: https://github.com/zed-industries/zed/blob/65e1c5af/crates/acp_thread/src/terminal.rs
🌐 Web query:
GitHub Zed prompt args shell_escape_run_command
💡 Result:
There is no documented Zed setting or command argument named shell_escape_run_command. The terminology you are asking about appears to relate to internal Rust source code within the Zed editor's utility crate [1] and issues surrounding how tasks handle argument quoting [2]. If you are encountering issues where task arguments are being incorrectly quoted (or not quoted) when passed to the shell, it is likely related to the internal Shell implementation in Zed [1]. Zed internally manages shell execution by mapping commands and arguments into a Shell enum structure, which differentiates between system defaults, specific programs, and programs with arguments [1]. Key technical context regarding Zed's task and shell execution: 1. Internal Quoting Logic: Zed uses internal logic (often involving shlex or similar quoting utilities) to ensure arguments are safe to pass to a shell [1][2]. This can sometimes lead to issues where arguments are double-quoted or where shell-specific syntax (like $ variables) is prematurely escaped or incorrectly handled depending on the target shell (e.g., POSIX, CMD, PowerShell) [1][2]. 2. Task Configuration: You can configure the shell used for tasks via the "shell" property in your tasks.json file, but you cannot manually toggle a "shell_escape_run_command" flag [3][4][5]. The configuration supports three primary modes: - "system" (default) [3][4] - A single program (e.g., "shell": { "program": "sh" }) [3][4] - A program with arguments (e.g., "shell": { "with_arguments": { "program": "/bin/bash", "args": ["--login"] } }) [3][4] 3. Troubleshooting: If you are experiencing unexpected behavior with arguments, it is typically an issue with how Zed's internal command spawning logic interacts with your specific shell's quoting requirements [2][6]. Users encountering these issues often track them in the main Zed repository as bugs, as there is no user-facing configuration to override the quoting behavior [2][5].
Citations:
- 1: https://github.com/zed-industries/zed/blob/2aa36660/crates/util/src/shell.rs
- 2: build_no_quote passes unquoted args to shell, breaking paths with $ characters zed-industries/zed#53046
- 3: https://github.com/zed-industries/zed/blob/main/docs/src/tasks.md
- 4: https://zed.dev/docs/tasks
- 5: Shell Not Changing in Zed Editor Task zed-industries/zed#30816
- 6: Spawn tasks with
shinstead of user's shell zed-industries/zed#33420
🌐 Web query:
Zed acp terminal shell_escape_run_command args "{{args}}" prompt template
💡 Result:
In Zed, the shell command execution system, particularly regarding ACP (Agent Client Protocol) and terminal tasks, involves careful handling of command-line arguments to ensure security and correctness [1][2][3]. The specific term shell_escape_run_command is not a user-facing configuration parameter, but rather relates to internal logic within the Zed codebase for handling terminal command execution [1][2][4]. Zed uses a ShellBuilder (or similar mechanisms in crates/util/src/shell.rs) to construct command lines [2][3]. When executing terminal tasks or ACP-originated commands, Zed must decide whether to escape arguments to prevent shell injection or syntax errors [1][3][4]. Key Technical Points: 1. Argument Handling and Escaping: Zed's internal ShellBuilder is responsible for building command lines by combining a program and its arguments [2][5]. Depending on the ShellKind (e.g., POSIX, Cmd, PowerShell), Zed determines whether to automatically escape arguments [3]. For many POSIX-like shells, Zed attempts to perform necessary escaping; however, this has been an active area of development to avoid issues with double-quoting or improper shell parsing [1][3][4]. 2. Prompt Templates: ACP agents use a template-based system for slash commands and custom prompts [6][7]. These templates reside in the .codex/prompts/ directory (or similar project-local configurations) [7]. The expansion system substitutes placeholders like $1, $2 (positional) or $ARG_NAME (named) with user-provided input [6][7]. A special $ARGUMENTS placeholder captures all remaining provided arguments [7]. This system is distinct from the terminal command execution logic, although agent-driven terminal commands are often generated as a result of these prompt expansions [8][6]. 3. Configuration and Shells: Users can override the shell used by Zed for tasks and terminals via settings.json under terminal.shell [9][10]. Zed typically executes these commands in a login shell to maintain environment consistency [10]. If a command fails or behaves unexpectedly (e.g., due to shell-specific syntax), it is often due to the terminal.shell setting requiring a bash-compatible shell or the environment being incorrectly loaded [11][10]. If you are encountering issues with arguments not being escaped correctly in terminal commands, this is often treated as an internal bug in the command construction logic, where the system may mistakenly concatenate arguments rather than passing them as an array to the underlying shell or executor [1][4].
Citations:
- 1: AI: ACP terminal seems to not escape provided args when forming sh command line zed-industries/zed#42646
- 2: https://github.com/zed-industries/zed/blob/65e1c5af/crates/acp_thread/src/terminal.rs
- 3: https://github.com/zed-industries/zed/blob/2aa36660/crates/util/src/shell.rs
- 4: build_no_quote passes unquoted args to shell, breaking paths with $ characters zed-industries/zed#53046
- 5: https://github.com/zed-industries/zed/blob/20a3f770/crates/acp_thread/src/terminal.rs
- 6: https://deepwiki.com/zed-industries/codex-acp/4.2-slash-commands-and-custom-prompts
- 7: https://context7.com/zed-industries/codex-acp/llms.txt?tokens=10000
- 8: https://github.com/zed-industries/zed/blob/main/crates/agent_servers/src/acp.rs
- 9: https://zed.dev/docs/terminal
- 10: https://zed.dev/docs/tasks?highlight=one-off
- 11: Zed uses terminal.shell settings outside of the terminal, breaking Codex, Claude, and Gemini ACP Agents zed-industries/zed#46551
🌐 Web query:
"shell_escape_run_command" "prompt" Zed
💡 Result:
"shell_escape_run_command" is not a public command or setting in the Zed editor [1][2]. Based on the Zed codebase, the term relates to internal Rust logic used by the editor's task system to manage process execution, specifically for quoting and escaping arguments passed to the shell [3][4]. Users interacting with Zed tasks do not use "shell_escape_run_command." Instead, Zed handles argument escaping automatically when you use the args array in your tasks.json configuration [5]. Key points regarding task execution and shell interaction in Zed: 1. Automatic Escaping: When you define a task, using the args array (e.g., ["${ZED_FILE}"]) ensures that paths containing spaces or special characters are correctly escaped by Zed's internal mechanisms before being passed to the shell [5]. 2. Shell Configuration: You can configure the shell used for tasks via the terminal.shell setting in your settings.json [1][6]. This can be set to the system default, a specific program, or a program with arguments [1][2]. 3. Internal Logic: Internally, Zed uses components like shell_builder.rs to manage these processes [4]. Methods like build_no_quote or others (often internal to the Zed crate) are used by the editor to determine how to format strings before they reach the shell, which has been a point of discussion in Zed's issue tracker regarding edge cases with file paths and variable interpolation [3][7][4]. If you are encountering issues with commands not executing as expected, it is recommended to use the args array in tasks.json rather than trying to manually escape shell strings [5]. If you are a contributor working on the Zed codebase, you may be seeing these terms within the crates/util/src/shell_builder.rs or similar utility files [4].
Citations:
- 1: https://zed.dev/docs/tasks?highlight=one-off
- 2: https://zed.dev/docs/tasks
- 3: build_no_quote passes unquoted args to shell, breaking paths with $ characters zed-industries/zed#53046
- 4: https://github.com/zed-industries/zed/blob/c958a12b/crates/util/src/shell_builder.rs
- 5: Tasks, $ZED_FILE and $ZED_DIRNAME doesn't escape spaces. zed-industries/zed#20521
- 6: https://zed.dev/docs/terminal
- 7: Zed uses terminal.shell settings outside of the terminal, breaking Codex, Claude, and Gemini ACP Agents zed-industries/zed#46551
Use the ACP shell-escaped command template for {{args}}.
{{args}} is documented as raw-substituted in this Zed prompt; wrapping the Bash invocation with the ACP shell-escaping format (!{bash "${extensionPath}/scripts/vs-record.sh" {{args}}}) prevents user-controlled shell metacharacters from escaping the intended command.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@commands/vs-record.toml` around lines 8 - 12, Update the command template in
the vs-record configuration to use the ACP shell-escaped format, wrapping the
existing bash invocation and {{args}} in !{...}. Preserve the script path and
verbatim output relay while ensuring user-controlled arguments cannot escape the
intended command.
| (`npm install`, `pip install`, `cargo add`, `dotnet add package`, ...). | ||
| 2. A `BeforeTool` hook fires and exits 2 — the tool call is blocked and the | ||
| hook's stderr explains why: | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add language tags to fenced code blocks.
Mark the stderr example as text and the command examples as bash so markdownlint MD040 passes.
Also applies to: 22-22, 33-33
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 15-15: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@GEMINI.md` at line 15, Update the fenced code blocks in GEMINI.md, including
the stderr example and command examples, to specify the appropriate language
tags: use text for stderr and bash for shell commands. Apply the same tags to
all referenced blocks so markdownlint MD040 passes.
Source: Linters/SAST tools
| # Safety: refuse to run inside a source checkout of the repo (would break Claude/Codex hooks). | ||
| case "$ROOT" in | ||
| *".gemini/extensions/"*) : ;; | ||
| *) | ||
| echo "version-sentinel: refusing to activate Gemini hooks outside a Gemini extension install." >&2 | ||
| echo " expected path under ~/.gemini/extensions/, got: $ROOT" >&2 | ||
| echo " install first: gemini extensions install https://github.com/KSEGIT/Version-Sentinel" >&2 | ||
| exit 1 | ||
| ;; | ||
| esac |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files:"
git ls-files | rg '(^|/)setup\.sh$|platforms/gemini/' || true
echo
echo "platforms/gemini/setup.sh:"
if [ -f platforms/gemini/setup.sh ]; then
cat -n platforms/gemini/setup.sh
fi
echo
echo "Search hooks/json writes and ROOT usage:"
rg -n 'ROOT|\.gemini/extensions|hooks\.json|Claude|Codex|extensions install|platforms/gemini' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200Repository: KSEGIT/Version-Sentinel
Length of output: 18935
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Demonstrate substring guard behavior:"
python3 - <<'PY'
paths = [
"/home/user/.gemini/extensions/version-sentinel/platforms/gemini/setup.sh",
"/tmp/source-checkout/.gemini/extensions/source/platforms/gemini/setup.sh",
"/tmp/source-checkout/with-patch/.gemini/extensions/source/platforms/gemini/setup.sh",
"/home/user/.gemini/extensions",
"/home/user/.gemini/extensions/",
]
for p in paths:
ok = "*\.gemini/extensions/*".replace("*","") in p
print(f"{ok=}: {p}")
PY
echo
echo "Show equivalent shell case using unquoted pattern and real file context:"
fn="$(mktemp '/tmp/ver-sentinel-setup-test.XXXXXX')"
cat > "$fn" <<'BASH'
#!/usr/bin/env bash
case "$ROOT" in
*".gemini/extensions/"*) echo "unquoted substring accepted: $ROOT" ;;
*) echo "rejected: $ROOT" ;;
esac
BASH
chmod +x "$fn"
export ROOT="/tmp/source-checkout/.gemini/extensions/source"; bash "$fn"
export ROOT="$(cd "$(dirname "$fn")/.." && pwd)"; bash "$fn"
rm -f "$fn"Repository: KSEGIT/Version-Sentinel
Length of output: 702
Use an exact Gemini extension-root check.
The guard pattern accepts any path containing .gemini/extensions/, so a source clone or checkout nested under that substring can pass the safety check and have its Claude/Codex hooks/hooks.json overwritten. Compare the resolved ROOT against the actual extension directory instead.
Proposed guard
-case "$ROOT" in
- *".gemini/extensions/"*) : ;;
+EXTENSIONS_ROOT="$(cd "${HOME}/.gemini/extensions" && pwd)"
+case "$ROOT" in
+ "$EXTENSIONS_ROOT"/*) : ;;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Safety: refuse to run inside a source checkout of the repo (would break Claude/Codex hooks). | |
| case "$ROOT" in | |
| *".gemini/extensions/"*) : ;; | |
| *) | |
| echo "version-sentinel: refusing to activate Gemini hooks outside a Gemini extension install." >&2 | |
| echo " expected path under ~/.gemini/extensions/, got: $ROOT" >&2 | |
| echo " install first: gemini extensions install https://github.com/KSEGIT/Version-Sentinel" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| EXTENSIONS_ROOT="$(cd "${HOME}/.gemini/extensions" && pwd)" | |
| # Safety: refuse to run inside a source checkout of the repo (would break Claude/Codex hooks). | |
| case "$ROOT" in | |
| "$EXTENSIONS_ROOT"/*) : ;; | |
| *) | |
| echo "version-sentinel: refusing to activate Gemini hooks outside a Gemini extension install." >&2 | |
| echo " expected path under ~/.gemini/extensions/, got: $ROOT" >&2 | |
| echo " install first: gemini extensions install https://github.com/KSEGIT/Version-Sentinel" >&2 | |
| exit 1 | |
| ;; | |
| esac |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@platforms/gemini/setup.sh` around lines 18 - 27, Update the safety guard in
setup.sh to require that ROOT exactly matches the resolved Gemini extension
directory, rather than accepting any path containing ".gemini/extensions/".
Preserve the refusal message and exit behavior for all other paths, including
source checkouts nested beneath that substring.
|
|
||
| **Source** must be an `http(s)://` URL or `intentional:<reason>`. | ||
|
|
||
| **Ecosystems (v0.1):** npm, pip, cargo, csproj, pyproject |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Update the stale ecosystem version marker.
The command documents “Ecosystems (v0.1)” while this PR synchronizes the project at v0.3.0. Update the marker or remove it so users are not given stale support information.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@platforms/kimi/commands/vs-record.md` at line 11, Update the “Ecosystems
(v0.1)” marker in the ecosystem support documentation to reflect the project’s
current v0.3.0 synchronization, or remove the version marker if it is no longer
needed; preserve the listed ecosystem names.
| - `/version-sentinel:vs-record csproj Serilog 3.1.1 intentional: CVE lock pending audit` | ||
|
|
||
| To execute this command, run the following with your Bash tool, passing the user's arguments through as-is: | ||
|
|
||
| bash "$KIMI_PLUGIN_ROOT/scripts/vs-record.sh" $ARGUMENTS |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)vs-record\.(sh|md)$|version-sentinel|commands/vs-record' || true
echo
echo "== platforms/kimi/commands/vs-record.md =="
cat -n platforms/kimi/commands/vs-record.md
echo
echo "== scripts/vs-record.sh outline/content =="
wc -l scripts/vs-record.sh 2>/dev/null || true
cat -n scripts/vs-record.sh 2>/dev/null || true
echo
echo "== search ARGUMENTS/usages =="
rg -n '\$?ARGUMENTS|intentional|version-sentinel' scripts platforms || true
echo
echo "== shell behavior probe =="
ARGUMENTS='Serilog 3.1.1 intentional: CVE lock pending audit'
printf 'unquoted:\n'
set -- bash scripts/vs-record.sh $ARGUMENTS
printf 'argv: %s\n' "$@"
printf 'quoted:\n'
set -- bash scripts/vs-record.sh "$ARGUMENTS"
printf 'argv: %s\n' "$@"
printf 'positional with args array (no extra source):\n'
set -- bash scripts/vs-record.sh csproj Serilog 3.1.1 'intentional: CVE lock pending audit'
printf 'argv: %s\n' "$@"Repository: KSEGIT/Version-Sentinel
Length of output: 10547
Pass the Kimi arguments without word-splitting.
$ARGUMENTS splits csproj Serilog 3.1.1 intentional: CVE lock pending audit into seven script args, so the validation treats intentional: as the source and rejects the command. Use the script’s defined positional args, e.g. $1 "$2" "$3" "$4", instead of expanding the whole argument string unquoted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@platforms/kimi/commands/vs-record.md` around lines 16 - 20, Update the
command invocation in vs-record so the script receives the defined positional
arguments without word-splitting: pass $1, "$2", "$3", and "$4" individually
instead of expanding $ARGUMENTS. Preserve the existing Bash script path and
argument order.
Sources: Coding guidelines, Learnings
| ap_content=$(echo "$input" | jq -r '.tool_input.content // .tool_input.new_content // empty') | ||
| if [[ -z "$ap_content" ]]; then | ||
| echo "version-sentinel: apply_patch targets manifest $ap_path but post-content cannot be reconstructed; fail-open" >&2 | ||
| exit 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate script =="
fd -a 'detect-manifest-edit\.sh$' . || true
echo "== show relevant sections =="
if [ -f scripts/detect-manifest-edit.sh ]; then
nl -ba scripts/detect-manifest-edit.sh | sed -n '1,120p'
fi
echo "== jq probe =="
jq -r 'def sel1(x): .tool_input.content // .tool_input.new_content // empty; sel1(input)' <<'JSON'
{"tool_input": {"content": "", "new_content": "new"}}
{"tool_input": {"content": null, "new_content": "new"}}
{"tool_input": {}}
JSON
echo "== search input payload handling =="
rg -n 'ap_content|tool_input|apply_patch|new_content' scripts -S || trueRepository: KSEGIT/Version-Sentinel
Length of output: 301
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file exists =="
ls -l scripts/detect-manifest-edit.sh
echo "== relevant section =="
awk '{printf "%d\t%s\n", NR, $0}' scripts/detect-manifest-edit.sh | sed -n '1,130p'
echo "== jq probe =="
jq -r 'def sel(x): .tool_input.content // .tool_input.new_content // empty; sel(input)' <<'JSON'
{"tool_input": {"content": "", "new_content": "new"}}
{"tool_input": {"content": null, "new_content": "new"}}
{"tool_input": {}}
{"tool_input": {"new_content": "new"}}
JSON
echo "== search input payload handling =="
grep -nE 'ap_content|tool_input|apply_patch|new_content' scripts/detect-manifest-edit.sh scripts/*.sh 2>/dev/null || trueRepository: KSEGIT/Version-Sentinel
Length of output: 10055
Fall back on empty content payloads too.
jq treats content: "" as present, so a valid new_content bypasses the post-image reconstruction guard. Since the fallback is meant only when no usable content is available, select a non-empty content field or reject the ambiguous payload instead of letting this fail-open.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/detect-manifest-edit.sh` around lines 49 - 52, Update the
post-content extraction in the manifest detection logic to select only non-empty
content or new_content values, rather than treating an empty content field as
usable. Ensure payloads with content: "" fall back to a non-empty new_content
when available, and otherwise remain subject to the reconstruction guard instead
of fail-opening.
Source: Coding guidelines
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 13 file(s) based on 13 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 13 file(s) based on 13 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
1 participant
Multi-agent support: Kimi, Copilot, Gemini, Codex, Zed, z.ai
Ports version-sentinel from Claude Code-only to six additional agent platforms. The hook scripts in
scripts/stay the portable core; each platform gets a thin adapter (manifest, hook wiring, commands). Tool-name differences are handled by a new normalization layer (scripts/lib/platform.sh), preserving the fail-open design and leaving the Claude baseline untouched.Platform adapters
kimi.plugin.json,platforms/kimi/commands/,kimi-marketplace.json.github/hooks/version-sentinel.json,.github/agents/,.github/prompts/,copilot-instructions.mdgemini-extension.json,GEMINI.md,commands/*.toml,hooks/gemini-hooks.json+platforms/gemini/setup.sh.codex-plugin/plugin.json(reuses Claude-schemahooks/hooks.json+ legacy marketplace compat)AGENTS.md,.agents/skills/,docs/zed.mdNotable findings from live e2e (details in
docs/e2e-checklist.md)tool_input.pathinstead oftool_input.file_path(regression test included).hooks/hooks.json(closed event enum, verified live), and always reads the conventional path — so Gemini hooks live inhooks/gemini-hooks.jsonand are activated inside the installed extension copy byplatforms/gemini/setup.sh.docs/e2e-checklist.md.Testing
bash tests/run.sh→ 26/26 pass (incl. newtest_platform_normalize,test_platform_payloads, Kimipathregression), also verified on bash 3.2.Housekeeping
0.3.0; release-pleaseextra-filesextended so they bump together on the next release.docs/marketplaces.mdtracks distribution/submission status per platform, incl. the owner-action-only steps (Anthropic directory form,gemini-cli-extensionGitHub topic, OpenAI portal).zai-org/zai-coding-pluginsmarketplace accompanies this change.Summary by CodeRabbit
New Features
Documentation
Bug Fixes
Tests