fix(security): remove stale package-lock.json (21 Dependabot alerts)#1337
Closed
ibuildthings-instrumentl wants to merge 33 commits intocoleam00:devfrom
Closed
fix(security): remove stale package-lock.json (21 Dependabot alerts)#1337ibuildthings-instrumentl wants to merge 33 commits intocoleam00:devfrom
ibuildthings-instrumentl wants to merge 33 commits intocoleam00:devfrom
Conversation
- Added a new configuration option to copy local .env files into isolated worktrees for Scout MCP compatibility. - Removed outdated note regarding Claude Code binary path from setup documentation. - Renumbered subsequent steps in the setup guide for clarity.
Update Archon configuration and setup documentation
Add design for a Slack @archie bot flow that takes a natural-language feature request end-to-end: interactive spec with bounded revision loop, plan, implement in worktree, open PR, bounded review loop, wait for CI, trigger review-app deploy, post URL back to the thread. Composes existing Archon commands plus three small helper scripts; no adapter changes required. Made-with: Cursor
Bite-sized tasks covering 3 helper scripts, the workflow YAML, bundled- defaults registration, pre-PR validation, and a manual smoke-test checklist. Noted divergences from the design doc: code-review rounds are unrolled explicitly, reviewApp config is hardcoded for v1, and per-script unit tests are dropped in favor of workflow-level parsing plus manual smoke test. Made-with: Cursor
Wraps gh workflow run for review-app deployment; exits non-zero with a clear message on dispatch failure. Used by archon-slack-feature-to-review-app. Note: written as .js (not .ts as originally planned) to match the existing .archon/scripts/echo-args.js pattern and avoid the typed-linting scope gap for .archon/scripts/**/*.ts. Made-with: Cursor
Wraps gh pr checks --watch --fail-fast with a wall-clock timeout so the workflow can't hang indefinitely. Exit codes distinguish pass/fail/timeout. Note: written as .js (not .ts as originally planned) for the same reason as dispatch-review-app.js. Made-with: Cursor
Polls gh pr view --json comments for a URL matching a caller-supplied regex; prints the URL on stdout, errors on stderr so the workflow engine captures only the URL via \$nodeId.output. Note: written as .js (not .ts as originally planned) for the same reason as dispatch-review-app.js. Made-with: Cursor
End-to-end workflow for Slack @archie feature requests: interactive spec creation (bounded 3-iteration revision loop), plan + implement + PR using existing commands, two-round code review with conditional second pass, CI wait, review-app dispatch, URL fetch from PR comments, and final post back to the Slack thread. Composes existing commands; adds no new adapter or orchestrator code. Script invocations use .js extensions per the Tasks 1-3 divergence. Made-with: Cursor
Adds the text import + map entry so binary builds include the workflow. Bumps the bundled-workflow count assertion from 13 to 14 and adds the workflow to the expected-names list. Made-with: Cursor
Insert an interactive refine-plan loop between create-plan and plan-setup, mirroring the existing spec-approval gate and the pattern used by archon-scout-perf-roadmap. The loop posts a condensed plan summary in-thread, accepts feedback that edits $ARTIFACTS_DIR/plan.md in place, and only proceeds to plan-setup on explicit "approved" / "looks good" / "ship it" / "go". Bounded at max_iterations: 5. Rationale: previously the workflow jumped straight from plan creation into implementation, giving the user no chance to reshape scope, ordering, or task list before code gets written. This symmetrizes the gating with Phase A and matches how other plan-driven workflows behave. Made-with: Cursor
Interactive-loop gate messages now render Approve (primary) and Request
changes buttons in Slack; clicking Approve resumes the paused workflow,
while Request changes opens a modal with a feedback textarea whose
submission is synthesized into the gate thread.
- packages/core: add optional `interactiveGate` to MessageMetadata.
- packages/workflows: dag-executor gate-send passes runId + nodeId via
the new metadata field so adapters can bind actions per run.
- packages/adapters/slack: sendMessage renders an actions block on the
final chunk when the gate metadata is present; Bolt action + view
handlers synthesize message events that reuse the existing
natural-language approval path in handleMessage, so no new server
wiring is required.
- Fallback path: adapters without rich input ignore the metadata; the
text body still includes the `/workflow approve <uuid>` instructions.
Tests:
- 3 new Slack adapter tests asserting the actions block, action_ids,
and that buttons attach only to the final chunk of long messages.
- 1 extra assertion on the dag-executor interactive-loop test verifying
the gate-send carries { runId, nodeId } metadata.
Made-with: Cursor
feat: @archie Slack feature-to-review-app workflow
feat(slack): Block Kit approve + request-changes UI for workflow loop gates
When a user @mentions or DMs Archon, the bot now posts an 👀 reaction on the incoming message the moment it's received -- before thread-history fetch, lock acquisition, planner warm-up, or first LLM token. This eliminates the awkward silent gap between "user hit send" and "bot responds" for long-running workflows. - SlackAdapter.acknowledgeReceipt(event) calls reactions.add; swallows errors so a missing reactions:write scope just skips the reaction instead of blocking the conversation. - Server onMessage handler fires the ack right after auth/stripBotMention with void (fire-and-forget) so the reaction round-trip never delays orchestration. - reactions:write added to the Starlight docs, skill guide, and CLI setup prompt as an optional scope. - Three adapter tests cover the happy path, missing-scope failure, and already_reacted replay case. Made-with: Cursor
feat(slack): ack incoming messages with 👀 reaction
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(deps): bump flatted to >=3.4.2 (Dependabot #19)
Fixes SSRF via NO_PROXY Hostname Normalization Bypass and Cloud Metadata Exfiltration via Header Injection Chain. Transitive from @slack/bolt and @slack/web-api. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(deps): bump axios to ^1.15.0 (coleam00#29, coleam00#30)
…oleam00#28) Fixes Custom Authentication Headers leak to Cross-Domain Redirect Targets. Transitive from axios. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(deps): bump follow-redirects to >=1.16.0 (Dependabot coleam00#28)
…, coleam00#27) Fixes Code Injection via _.template and Prototype Pollution via _.unset/_.omit. Transitive from @sapphire/shapeshift (discord.js). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(deps): bump lodash to >=4.18.0 (Dependabot coleam00#26, coleam00#27)
…leam00#24, coleam00#25) Fixes ReDoS via multiple wildcards and DoS via sequential optional groups. Transitive from @slack/bolt. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(deps): bump path-to-regexp to >=8.4.0 (Dependabot coleam00#24, coleam00#25)
…0#21) Fixes Method Injection in POSIX Character Classes causing incorrect Glob Matching. Transitive from astro, @rollup/pluginutils, and others. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix(deps): bump picomatch to >=4.0.4 (Dependabot coleam00#21)
Fixes 6 vulnerabilities: WebSocket memory/exception issues, CRLF injection, 64-bit length overflow, HTTP smuggling, unbounded decompression. Transitive from discord.js and @discordjs/rest. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…t alerts The project migrated from npm to Bun in commit c85622f, but the old package-lock.json was never removed. All 21 open Dependabot security alerts (axios, lodash, undici, minimatch, path-to-regexp, flatted, follow-redirects, picomatch, qs) target this stale lockfile. The actual dependency versions in bun.lock are already newer. Removes the file and adds it to .gitignore to prevent re-introduction. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR introduces an end-to-end interactive workflow for converting Slack feature requests to deployable review apps, including Scout performance optimization pipelines, new CLI helper scripts for CI/review app automation, interactive approval gates in Slack, and workflow heartbeat status messages for chat platforms. Changes
Sequence Diagram(s)sequenceDiagram
participant User as Slack User
participant Slack as Slack Thread
participant Orchestrator as Workflow Orchestrator
participant CodeReview as Code Review Agents
participant CI as CI System
participant ReviewApp as Review App Deployment
participant PrRepo as Pull Request
User->>Slack: Request feature via `@archie`
Slack->>Orchestrator: Extract feature request
Orchestrator->>Orchestrator: Loop: Spec creation + approval
Note over Orchestrator: Up to 3 iterations<br/>or explicit SPEC_APPROVED
Orchestrator->>Slack: Post spec, await approval
Slack->>Slack: User approves
Orchestrator->>Orchestrator: Plan + Implementation
Orchestrator->>PrRepo: Create Draft PR
Orchestrator->>CodeReview: Round 1: Parallel review agents
CodeReview->>CodeReview: Synthesize findings
alt Has Blocking Issues
Orchestrator->>Orchestrator: Apply fixes
Orchestrator->>CodeReview: Round 2: Re-review
CodeReview->>CodeReview: Synthesize again
end
Orchestrator->>CI: Wait for PR checks
Note over Orchestrator: Enforce 60-min timeout
CI->>Orchestrator: Checks pass
Orchestrator->>ReviewApp: Dispatch deployment workflow
ReviewApp->>ReviewApp: Deploy PR branch
Orchestrator->>PrRepo: Poll comments for URL
PrRepo->>Orchestrator: Extract URL via regex
Orchestrator->>Slack: Post final message<br/>with PR & review-app URLs
sequenceDiagram
participant Workflow as Interactive Loop Node
participant SlackAdapter as Slack Adapter
participant Slack as Slack
participant User as Slack User
Workflow->>SlackAdapter: sendMessage(text, metadata: interactiveGate)
SlackAdapter->>SlackAdapter: Encode runId/nodeId in action IDs
SlackAdapter->>Slack: Post with Approve & Request buttons
Slack->>User: Display message + buttons
User->>Slack: Click Approve
Slack->>SlackAdapter: block_action (approve action)
SlackAdapter->>SlackAdapter: Decode runId/nodeId
SlackAdapter->>Slack: chat.update message
SlackAdapter->>Workflow: Synthetic thread message: "approved"
Workflow->>Workflow: Emit PROMISE_APPROVED
alt User Clicks Request Changes
User->>Slack: Click Request changes
Slack->>SlackAdapter: block_action (request action)
SlackAdapter->>Slack: Open modal with feedback form
User->>Slack: Submit feedback
Slack->>SlackAdapter: modal submission
SlackAdapter->>Workflow: Synthetic message with feedback
end
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~75 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package-lock.jsonthat was left behind after the npm → Bun migration (commitc85622fb)package-lock.jsonto.gitignoreto prevent re-introductionContext
The project migrated to Bun and uses
bun.lockas the authoritative lockfile. The oldpackage-lock.jsoncontained outdated transitive dependency versions that Dependabot flagged:The actual versions in
bun.lockare already newer for most of these packages.Test plan
bun.lockexists and is the active lockfilepackage-lock.jsonmain🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Updates
reactions:writescope for enhanced interaction features.