Repository navigation
Quality Gates → 100% (Fase 6A + Fase 7 + plano Fase 8) - #3757
Conversation
…ality.yml, gate docs (6A.3-helper/6A.4/6A.5/6A.6)
…copes, known-symbols v2, test-masking v2, file-size/complexity electron+bin, stale-enforcement across gates (6A.3-resto/6A.7/6A.8/6A.9/6A.10/6A.11)
… gate, pre-push reactivated, run-all-gates aggregator (6A.12)
…pi/i18n coverage metrics, eslintErrors floor, conscious eslint re-baseline 3501->3653) (INT-6A)
…cognitive-complexity, type-coverage, lockfile-lint, size-limit, dpdm circular, license-compliance, pr-evidence (7.4/7.5/7.6/7.7/7.10/7.12/7.16/7.20)
…nce (pr-test-policy) (INT-7 part1)
…ackups/exportAll as local-only (P1 from 6A.8 route-guard gate — RCE-via-tunnel surface) The 6A.8 route-guard gate found two spawn-capable routes reachable past the loopback gate: /api/system/version (git checkout + npm install) and /api/db-backups/exportAll (tar). A leaked JWT over a tunnel could trigger them. Classified both in LOCAL_ONLY_API_PREFIXES (loopback enforced before auth), emptied the gate's frozen-debt set, TDD red->green.
…s/actionlint+zizmor scans, stryker/axe/semcheck configs, sonar destrava exclusions, anti-slopsquat age-check + per-module coverage; wire quality-extended advisory job (7.1/7.2/7.3/7.8/7.9/7.11/7.13/7.14/7.18/7.19)
…), contracts (fast-check/golden/SSE), resilience (toxiproxy/heap), LLM-security (promptfoo/garak)
…re-set (7.10 pr-evidence introduced it)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements Fase 7 quality gates and security audits, introducing automated checks for bundle size, circular dependencies, CodeQL alerts, cognitive complexity, dead code, license compliance, lockfile linting, tracked artifacts, type coverage, vulnerability scanning, and workflow auditing. It also updates the route guard to restrict spawn-capable routes (/api/system/version and /api/db-backups/exportAll) to loopback-only to prevent RCE. The review feedback is highly valuable, pointing out several critical Windows compatibility issues where executing .bin wrappers or npm directly via execFileSync will fail, as well as potential TypeError crashes in the quality ratchet script when baseline files are missing.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| stdout = execFileSync("node", [binPath, "--json"], { | ||
| encoding: "utf8", | ||
| cwd, | ||
| maxBuffer: 8 * 1024 * 1024, | ||
| }); |
There was a problem hiding this comment.
Running node with binPath (which points to node_modules/.bin/size-limit) will fail on modern npm versions (npm v9+). This is because the files in .bin/ are shell wrapper scripts rather than direct JavaScript files, causing Node.js to throw a SyntaxError when attempting to parse them.\n\nInstead, we should execute the binary directly, enabling shell execution on Windows to resolve the .cmd wrapper.
stdout = execFileSync(binPath, [\"--json\"], {\n encoding: \"utf8\",\n cwd,\n maxBuffer: 8 * 1024 * 1024,\n shell: process.platform === \"win32\",\n });| for (const [key, spec] of Object.entries(baseline.metrics)) { | ||
| const current = metrics[key]; | ||
| const base = spec.value; | ||
| const dir = spec.direction; // "down" = menor-é-melhor | "up" = maior-é-melhor |
There was a problem hiding this comment.
If ALLOW_MISSING is enabled and the baseline file is missing, load(BASELINE) returns {}. Consequently, baseline.metrics will be undefined, causing Object.entries(baseline.metrics) to throw a TypeError and crash the script.\n\nWe should safely default baseline.metrics to an empty object {} to prevent this crash.
for (const [key, spec] of Object.entries(baseline.metrics || {})) {\n const current = metrics[key];\n const base = spec.value;\n const dir = spec.direction; // \"down\" = menor-é-melhor | \"up\" = maior-é-melhor| } | ||
|
|
||
| // Behavior 3: warn about orphan metrics (present in collected metrics but absent in baseline). | ||
| const baselineKeys = new Set(Object.keys(baseline.metrics)); |
There was a problem hiding this comment.
Similarly, baseline.metrics can be undefined if the baseline file is missing or empty under ALLOW_MISSING. We should safely guard Object.keys here as well.
| const baselineKeys = new Set(Object.keys(baseline.metrics)); | |
| const baselineKeys = new Set(Object.keys(baseline.metrics || {})); |
| export function isBinaryAvailable(name) { | ||
| // Use `command -v` on Unix; `where` on Windows (via cmd). | ||
| // We shell through `sh -c` because execFileSync needs the actual path | ||
| // and we want cross-platform behaviour. | ||
| const result = spawnSync("sh", ["-c", `command -v ${name}`], { | ||
| encoding: "utf8", | ||
| timeout: 5_000, | ||
| windowsHide: true, | ||
| }); | ||
| return result.status === 0 && result.stdout.trim().length > 0; | ||
| } |
There was a problem hiding this comment.
The implementation of isBinaryAvailable does not match the comment's claim of supporting Windows via where. Spawning sh directly will fail on Windows environments where sh is not available in the PATH.\n\nWe can make this check robust and cross-platform by using shell: true and choosing the appropriate command based on the platform.
export function isBinaryAvailable(name) {\n const isWin = process.platform === \"win32\";\n const cmd = isWin ? \"where \" + name : \"command -v \" + name;\n const result = spawnSync(cmd, {\n shell: true,\n encoding: \"utf8\",\n timeout: 5000,\n windowsHide: true,\n });\n return result.status === 0 && result.stdout.trim().length > 0;\n}| const raw = execFileSync( | ||
| "npm", | ||
| ["view", pkgName, "time.created", "--json"], | ||
| { | ||
| encoding: "utf8", | ||
| timeout: timeoutMs, | ||
| // Suppress npm progress/warn output on stderr | ||
| stdio: ["ignore", "pipe", "pipe"], | ||
| } | ||
| ); |
There was a problem hiding this comment.
Executing \"npm\" directly via execFileSync will fail on Windows because npm is distributed as a batch script (npm.cmd) rather than a direct executable.\n\nWe can resolve this by dynamically selecting the correct command name based on the platform.
const raw = execFileSync(\n process.platform === \"win32\" ? \"npm.cmd\" : \"npm\",\n [\"view\", pkgName, \"time.created\", \"--json\"],\n {\n encoding: \"utf8\",\n timeout: timeoutMs,\n // Suppress npm progress/warn output on stderr\n stdio: [\"ignore\", \"pipe\", \"pipe\"],\n }\n );| const output = execFileSync(CHECKER_BIN, ["--production", "--json"], { | ||
| cwd: ROOT, | ||
| encoding: "utf-8", | ||
| maxBuffer: 32 * 1024 * 1024, // 32 MB | ||
| }); |
There was a problem hiding this comment.
Executing CHECKER_BIN directly via execFileSync will fail on Windows because the binary in .bin/ is a shell/batch wrapper rather than a direct executable.\n\nWe can fix this by enabling shell execution on Windows.
const output = execFileSync(CHECKER_BIN, [\"--production\", \"--json\"], {\n cwd: ROOT,\n encoding: \"utf-8\",\n maxBuffer: 32 * 1024 * 1024, // 32 MB\n shell: process.platform === \"win32\",\n });| try { | ||
| const output = execFileSync(bin, args, { encoding: "utf8" }); |
There was a problem hiding this comment.
Executing bin directly via execFileSync will fail on Windows because the binary in .bin/ is a shell/batch wrapper rather than a direct executable.\n\nWe can fix this by enabling shell execution on Windows.
try {\n const output = execFileSync(bin, args, {\n encoding: \"utf8\",\n shell: process.platform === \"win32\",\n });| @@ -31,7 +33,7 @@ export function evaluateDuplication(current, baseline, eps = EPS) { | |||
|
|
|||
| function measureDuplicationPct() { | |||
| const out = fs.mkdtempSync(path.join(os.tmpdir(), "jscpd-")); | |||
There was a problem hiding this comment.
Executing JSCPD_BIN directly via execFileSync will fail on Windows because the binary in .bin/ is a shell/batch wrapper rather than a direct executable.\n\nWe can fix this by enabling shell execution on Windows.
execFileSync(JSCPD_BIN, [...JSCPD_FIXED_ARGS, \"--output\", out], {\n stdio: \"ignore\",\n shell: process.platform === \"win32\",\n });| stdout = execFileSync(ESLINT_BIN, ESLINT_ARGS, { | ||
| encoding: "utf8", | ||
| maxBuffer: 64 * 1024 * 1024, | ||
| }); |
There was a problem hiding this comment.
Executing ESLINT_BIN directly via execFileSync will fail on Windows because the binary in .bin/ is a shell/batch wrapper rather than a direct executable.\n\nWe can fix this by enabling shell execution on Windows.
stdout = execFileSync(ESLINT_BIN, ESLINT_ARGS, {\n encoding: \"utf8\",\n maxBuffer: 64 * 1024 * 1024,\n shell: process.platform === \"win32\",\n });| stdout = execFileSync(typeCoverageBin, ["--json-output", "-p", TSCONFIG], { | ||
| encoding: "utf8", | ||
| maxBuffer: 32 * 1024 * 1024, | ||
| cwd: ROOT, | ||
| }); |
There was a problem hiding this comment.
Executing typeCoverageBin directly via execFileSync will fail on Windows because the binary in .bin/ is a shell/batch wrapper rather than a direct executable.\n\nWe can fix this by enabling shell execution on Windows.
stdout = execFileSync(typeCoverageBin, [\"--json-output\", \"-p\", TSCONFIG], {\n encoding: \"utf8\",\n maxBuffer: 32 * 1024 * 1024,\n cwd: ROOT,\n shell: process.platform === \"win32\",\n });… v3.8.24 merges These 5 files exceeded the frozen baseline solely because of already-merged, already-reviewed v3.8.24 PRs that landed after this branch froze its baseline: - src/lib/providers/validation.ts 4209→4302 (#3767 qwen-web fix) - src/shared/components/RequestLoggerV2.tsx 1232→1276 (#3760 logs light-mode) - open-sse/executors/antigravity.ts 1553→1572 (#3766 antigravity refresh) - open-sse/executors/base.ts 1199→1205 (#3756 xhigh effort) - open-sse/translator/response/openai-responses.ts 873→878 (#3762 tool-call integrity) None are touched by this branch; the bump reflects current release reality.
…t merge #3764 #3764 (self-hosted Material Symbols icon font) added material-symbols@^0.45.1 as a real dashboard dependency (used by CommandPalette and the icon set). It landed on release after this branch froze dependency-allowlist.json, so the check:deps gate flagged it as an unreviewed dep. Confirmed legitimate (Google Material Symbols, present in package.json + used across src/shared/components) and added to the allowlist.
|
Merging into |
…contributor credits - Restructure [3.8.24] into ✨ Features / 🔒 Security / 🐛 Fixed / 📝 Maintenance - Add bullets for every PR landed since v3.8.23 that was missing: marketplace (#3656), strict-mode CC defaults (#3776), emergency-fallback flag (#3752), xhigh effort (#3756), Codex memory WS (#3749), IPv6 egress (#3777), marketplace SSRF (#3774), CodeQL/Dependabot (#3778), anthropic sampling (#3780), thinking passthrough (#3775), mcp dist entry (#3765), streamed tool args (#3762), logs light-mode (#3760), clean-history purge (#3751), quality-gates (#3757), docs gaps (#3453), file-size re-baseline (#3770), E415 publish guard, i18n prune - Move misplaced #3775 bullet out of [Unreleased] into [3.8.24] - Date [3.8.23] header (TBD -> 2026-06-12, the release tag date)
…ES row The `check:doc-links` table row in docs/architecture/QUALITY_GATES.md (added this cycle by #3757) used a literal `[text](path)` example inside inline code. The link checker strips fenced code blocks but not inline backticks, so it parsed that example as a real link to a 'path' file that does not exist — turning the 'Docs Sync (Strict)' CI job (npm run check:docs-all) red. Reworded to break the `](` adjacency; check:doc-links now passes (655 links, 0 broken).
…ence#3757) Quality Gates → 100% (Fase 6A + Fase 7 + plano Fase 8). Reconciled file-size + dep allowlist for concurrent v3.8.24 merges. Integrated into release/v3.8.24.
…contributor credits - Restructure [3.8.24] into ✨ Features / 🔒 Security / 🐛 Fixed / 📝 Maintenance - Add bullets for every PR landed since v3.8.23 that was missing: marketplace (cheaper-inference#3656), strict-mode CC defaults (cheaper-inference#3776), emergency-fallback flag (cheaper-inference#3752), xhigh effort (cheaper-inference#3756), Codex memory WS (cheaper-inference#3749), IPv6 egress (cheaper-inference#3777), marketplace SSRF (cheaper-inference#3774), CodeQL/Dependabot (cheaper-inference#3778), anthropic sampling (cheaper-inference#3780), thinking passthrough (cheaper-inference#3775), mcp dist entry (cheaper-inference#3765), streamed tool args (cheaper-inference#3762), logs light-mode (cheaper-inference#3760), clean-history purge (cheaper-inference#3751), quality-gates (cheaper-inference#3757), docs gaps (cheaper-inference#3453), file-size re-baseline (cheaper-inference#3770), E415 publish guard, i18n prune - Move misplaced cheaper-inference#3775 bullet out of [Unreleased] into [3.8.24] - Date [3.8.23] header (TBD -> 2026-06-12, the release tag date)
…ES row The `check:doc-links` table row in docs/architecture/QUALITY_GATES.md (added this cycle by cheaper-inference#3757) used a literal `[text](path)` example inside inline code. The link checker strips fenced code blocks but not inline backticks, so it parsed that example as a real link to a 'path' file that does not exist — turning the 'Docs Sync (Strict)' CI job (npm run check:docs-all) red. Reworded to break the `](` adjacency; check:doc-links now passes (655 links, 0 broken).
Quality Gates → 100% (Fase 6A + Fase 7)
Completa a iniciativa de quality-gates: as 10 tasks restantes da Fase 6A (endurecimento sistêmico) e a Fase 7 inteira (20 gates de segurança/dead-code/mutação/ferramental community). Plano de execução e Fase 8 documentados.
✅ Fase 6A (10/10 — 4 commits)
stale-allowlist+ aplicado em ~10 gates (⭐ pegou 1 stale real: migration041fantasma)docs/architecture/QUALITY_GATES.md+ seção no CLAUDE.md--require-tighten,epspor métrica, métrica órfã.github/workflows/quality.yml(gates rápidos em PR→release/**)✅ Fase 7 (20 gates)
**/*neutralizadoras)🔒 Achados de segurança/compliance
/api/system/version(git checkout + npm install) e/api/db-backups/exportAll(tar) eram spawn-capable SEM classificação local-only → RCE-via-túnel. Classificadas emLOCAL_ONLY_API_PREFIXES(TDD).tls-client-nodeusa Commons Clause (restringe venda comercial) — exceção registrada para revisão.Validação
PR_BODYenv) corrigida🤖 Generated with Claude Code