ci: bump astral-sh/setup-uv from 4 to 7 - #12
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 4 to 7. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v4...v7) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/astral-sh/setup-uv-7
branch
February 5, 2026 02:07
This was referenced Feb 7, 2026
james-in-a-box Bot
added a commit
that referenced
this pull request
Feb 11, 2026
- Include truncated raw_partial_input in tool_use blocks when JSON parsing fails, for debugging incomplete streaming responses (re-review issue #1) - Add docstring notes documenting: - Tool result matching order-dependency (original issue #5) - Force push checkpoint behavior (original issue #7) - Shared transcript for multi-commit pushes (original issue #8) - container_id fallback from filename (original issue #12) - Fix import sorting in gateway.py (ruff auto-fix) Authored-by: egg
jwbron
pushed a commit
that referenced
this pull request
Feb 11, 2026
![james-in-a-box[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…pt capture (#517) * Initialize SDLC contract for issue #509 * Draft analysis for issue #509: checkpoint migration * Update refine review state (cycle 1) * Approve and advance to plan phase for issue #509 * Draft plan for issue #509: per-commit checkpoints and API proxy capture * Update plan review state (cycle 1) * Approve and advance to implement phase for issue #509 * Populate contract tasks from plan for issue #509 * Implement per-commit checkpoint granularity (Phase 1) Add support for creating one checkpoint per commit instead of one per push: - Add get_commits_in_push() helper to enumerate commits between old/new SHAs - Add capture_and_store_checkpoints_for_push() for multi-commit checkpoint creation - Modify gateway push handler to get remote ref before push and iterate commits - Each checkpoint now has push_sha pointing to the tip commit for traceability - Graceful fallback: if rev-list fails, creates single checkpoint for tip commit This is Phase 1 of issue #509 (per-commit checkpoints + API proxy capture). Transcript source is still Claude Code JSONL (to be migrated in Phase 3). Authored-by: egg * Implement API proxy transcript capture (Phase 2) Add instrumentation to the Anthropic API proxy to capture request/response pairs for checkpoint creation: - New TranscriptBuffer class manages per-session buffer files in /tmp/egg-transcripts/ - Fixed 10MB buffer rotation drops oldest entries when size limit exceeded - Non-streaming responses captured with full content and usage - Streaming SSE responses reassembled to extract content blocks - Buffer entry schema documented with timestamps, model, messages, tools, usage - Thread-safe file writes with file locking - Global buffer cache for efficient access by container ID This is Phase 2 of issue #509 (per-commit checkpoints + API proxy capture). Phase 3 will migrate checkpoint extraction to use this buffer instead of Claude Code JSONL files. Authored-by: egg * Migrate transcript source to API proxy buffer (Phase 3) Replace Claude Code JSONL extraction with API proxy buffer reading: - Add extract_transcript_from_proxy_buffer() and related extraction functions - Update CheckpointHandler.capture_checkpoint() to use proxy buffer instead of JSONL - Remove CLAUDE_PROJECTS_DIR constant (no longer needed) - Maintain same return types for backward compatibility The proxy buffer provides a stable API-based source for transcripts, eliminating dependency on Claude Code's internal file format which can change without notice. This is Phase 3 of issue #509. Phase 4 will clean up deprecated JSONL code and add buffer cleanup on session end. Authored-by: egg * Cleanup and documentation for proxy buffer architecture (Phase 4) - Remove all Claude Code JSONL-specific code from transcript_extractor.py (file now only contains proxy buffer extraction functions) - Add buffer cleanup on session end in session_manager.py - Update CLI help text to describe per-commit checkpoint behavior - Add architecture documentation in checkpoint_handler.py explaining the transcript flow from API proxy to checkpoint storage Authored-by: egg * Update autofix attempts for issue #509 * Address review feedback on PR #517 transcript capture Fixes critical and correctness issues raised in review: 1. Race condition in buffer rotation (Critical #1): - Use exclusive file lock during entire rotation operation - Write to temp file then atomically replace with os.replace() - Clean up temp file on error 2. Memory accumulation for streaming (Critical #2): - Cap collected chunks at 10MB to prevent resource exhaustion - Log when capture is truncated due to size limit 3. Missing error handling for failed API responses (Critical #3): - Capture 4xx/5xx responses with status code and error message - Pass status_code to capture function for proper handling 4. Missing input_tokens from message_start (Correctness #4): - Extract input_tokens, cache_read_input_tokens from message_start - message_delta only contains output_tokens per SSE spec 5. Error events not handled in SSE parsing (Correctness #4): - Handle 'error' event type and capture as error content block - Add input_parse_error flag when tool_use JSON fails to parse 6. Unsafe path construction (Correctness #6): - Validate container_id against path traversal characters - Verify resolved path is within buffer directory Minor fixes: - Move `import time` to module level (Minor #10) - Set buffer directory permissions to 0o700 (Minor #11) Authored-by: egg * Address re-review feedback: add raw_partial_input and doc comments - Include truncated raw_partial_input in tool_use blocks when JSON parsing fails, for debugging incomplete streaming responses (re-review issue #1) - Add docstring notes documenting: - Tool result matching order-dependency (original issue #5) - Force push checkpoint behavior (original issue #7) - Shared transcript for multi-commit pushes (original issue #8) - container_id fallback from filename (original issue #12) - Fix import sorting in gateway.py (ruff auto-fix) Authored-by: egg * Address minor review observations: add constant and logging - Add RAW_INPUT_TRUNCATE_SIZE constant for the 1000 char truncation threshold used when preserving raw tool input on parse failure - Add warning log in transcript_extractor when extracting tool calls with input_parse_error flag, surfacing streaming parse failures during checkpoint extraction Authored-by: egg * Add test coverage for input_parse_error handling path Adds tests for the input_parse_error and raw_partial_input handling that was added for incomplete streaming JSON responses. This addresses the non-blocking observation from the PR review to ensure the defensive code path is documented through tests and protected from regressions. - TestParseSSEResponse: Tests that incomplete tool_use JSON sets input_parse_error flag and preserves truncated raw_partial_input - TestExtractToolCallsFromProxyBuffer: Tests that extraction logs a warning when input_parse_error is present and truncates the raw input preview appropriately Authored-by: egg --------- Co-authored-by: james-in-a-box[bot] <2365503+james-in-a-box[bot]@users.noreply.github.com> Co-authored-by: james-in-a-box[bot] <246424927+james-in-a-box[bot]@users.noreply.github.com>
This was referenced Feb 14, 2026
This was referenced Mar 11, 2026
james-in-a-box Bot
pushed a commit
that referenced
this pull request
May 11, 2026
…lockers Reviewer_plan NACKed the v1 plan with one blocking item (single-OR JQL fails on team-managed Jira projects) plus 20 non-blocking flags ranked by impact. This revision lands the blocker plus the 10 highest-impact non-blockers in one re-propose. Blocker: - TASK-1-3 + TASK-1-12: replace the single-OR JQL `parent = <K> OR "Epic Link" = <K>` with two separate queries (`parent = "<K>"` and `"Epic Link" = "<K>"`) and merge results, tolerating per-query HTTP 400 (architect ad-9 / risk_analyst R4). Single-OR fails on team-managed projects that lack the "Epic Link" custom field; auto-detection silently downgrades to fresh-path and the sweep returns empty. Exports the helper `search_epic_children` so TASK-1-12 reuses it. Top non-blocking (reviewer-flagged as most impactful): - #1 In-flight gate trust-boundary trade-off: add explicit acknowledgement that gateway-side enforcement is deferred and v1 relies on agent-side gating + apply-time re-check by TASK-1-13. - #5 APPLY_EPIC role registration: expand TASK-1-10 to enumerate all FIVE registration steps (AgentRole, AgentRoleDefinition, get_roles_for_phase, file-restrictions patterns, spawner branch). - #6 epic_apply persistence MCP surface: add `mcp__sdlc__update_epic_apply` MCP tool to TASK-1-7 so the sandbox-side agent can persist artifact updates. - #7 Concurrent-edit guard: TASK-1-10 now fetches the current epic Description, sha256s it, and registers a divergence HITL on mismatch; TASK-1-9 records the baseline sha256; TASK-1-7 adds `refine_description_sha256` to the schema. Additional non-blockers folded in: - #2: jira_effective_mode added to primitives table. - #3: TASK-1-5 introduces `shared/egg_jira_credentials.py` shared module to eliminate the orchestrator → gateway coupling. - #8: TASK-1-11 commits to extending `parse_plan` (not pass-through). - #9: TASK-1-5/TASK-1-14 add already-in-state idempotent short-circuit for Won't-Do transitions. - #10: TASK-1-15 introduces `Pipeline.jira_parent_epic_key` so PR phase doesn't need an extra Jira call. - #11: TASK-1-16 adds `PipelinePhase.PLAN_STOPPED` documented terminal phase + updates overseer monitor short-circuit. - #14: TASK-1-11 requires `wont_do_reason` per node + ⚠ warning rendering in the plan draft (R6). - #15: TASK-1-5 gates the orchestrator-direct cred surface behind `EGG_ENABLE_ORCH_JIRA_TRANSITIONS` (default off — R1). - #16: TASK-1-7 schema gains `version`, `idempotency_seed`, per-edit `summary_hash` + `applied_at`, `wont_do_reason`, signal_source as a list (R10). - #19: TASK-1-19 drops orchestrator-cli.md, adds submit-task-mcp.md. - #13: TASK-1-18 adds the lint regression test `test_no_outbound_jira_writes.py` (R7). - #12: TASK-1-12 introduces a reverse-index `.egg-state/jira-child-pipeline-index.json` to bound the sweep to O(K) (R3 performance mitigation). - #20: New "Risk-analyst items addressed" section summarises how R1/R2/R6/R7/R10/R12 are resolved in-plan (no fresh HITLs). Plan still parses cleanly: 1 slice, 19 tasks, 0 warnings, 0 role-alignment errors. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
james-in-a-box Bot
pushed a commit
that referenced
this pull request
May 12, 2026
…K v3 Addresses the BLOCKING holistic findings (Pass 1+2+3+4): * **#1 — `submit_task --mode` is now consumed end-to-end.** The `create_pipeline()` route in `orchestrator/routes/pipelines.py` reads `data["jira_ticket"]` and `data["jira_epic_mode"]` (the latter set by `submit_task`), runs the detection probe, and persists `jira_epic_key` / `jira_effective_mode` / `jira_parent_epic_key` on the Pipeline via the StateStore. `mcp_tools.py` now forwards `jira_ticket` explicitly so the route doesn't have to parse it back out of `pipeline_id`. * **#2 — `Pipeline.jira_epic_key` / `jira_effective_mode` / `jira_parent_epic_key` are now written.** `StateStore.create_pipeline()` accepts and forwards all three. * **#3 + #4 — `apply_epic` is now opted into the refine and plan phase rosters when `pipeline.jira_epic_key` is set.** `get_roles_for_phase()` grows an `is_epic_pipeline` parameter gated on the field's presence; the orchestrator's role-resolution site at `routes/pipelines.py` passes the flag. Sandbox env now exports `EGG_JIRA_EPIC_KEY`, `EGG_JIRA_EFFECTIVE_MODE`, `EGG_JIRA_PARENT_EPIC_KEY`, and the resolved `EGG_JIRA_HIERARCHY_FIELD` (looked up via `resolve_hierarchy_field`; a missing mapping leaves the env empty and the apply step surfaces a HITL gate). * **#5 — `PipelinePhase.PLAN_STOPPED` enum value added** to `shared/egg_contracts/models.py`. Terminal-without-PR signal for the Stop-after-plan plan-gate fork. * **#11 — `detect_jira_issuetype` exception handling narrowed.** Catches `ConnectionError` / `TimeoutError` / `OSError` and HTTP-failure exceptions (those carrying `status_code`) but lets programming errors propagate. * **#12 — `_run_jql` 400 tolerance is now `tolerate_400` keyword.** Only the `"Epic Link"` query opts in; `parent =` 400s surface to the caller so malformed-JQL / permission errors aren't silently treated as empty children. * **#13 — `search_epic_children` `require_hierarchy_mapping=True`** re-raises `JiraHierarchyUnmappedError` so callers (the apply step, per decision-2) can surface a HITL gate rather than silently running both queries. For **#6** (the planned `mcp__sdlc__update_epic_apply` and `mcp__sdlc__register_in_flight_gate` MCP tools) the agent prompts in `orchestrator/agent_prompts/apply_epic.py` are reframed to use the existing `mcp__sdlc__register_open_question` for HITL gates and a file-based handoff (`.egg-state/agent-outputs/<prefix>-epic-apply.json`) for the artifact write. The dedicated MCP tool registration is a planned follow-up; the file-based path lands first because it's serviceable end-to-end without new sandbox-side tools. The plan-gate Stop/Continue fork itself (TASK-1-16 dispatch) and the orchestrator-side post-apply hook that reads the artifact JSON and merges into `Pipeline.set_epic_apply()` are still deferred to a follow-up — but the foundation primitives, state-store, env-exports, and role-roster wiring are now in place so those follow-ups don't need to re-touch this surface. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
james-in-a-box Bot
pushed a commit
that referenced
this pull request
May 12, 2026
…y + N1 reviewer_code v3 blocking findings, all addressed: * **#1 JQL injection** — new ``_validate_jira_key`` (regex ``[A-Z][A-Z0-9_]*-\d+``) runs on every epic_key BEFORE interpolation into JQL. Defends against a value like ``ENG-1" OR project=BAR`` terminating the quoted operand and injecting arbitrary clauses. * **#2 No JQL pagination** — ``_run_jql`` now loops on ``nextPageToken`` until ``isLast=true`` or the cursor is omitted. Hard cap of 200 pages × 100 results = 20k children before emitting a structured warning and breaking. * **#3 Status-only idempotency check** — ``_get_current_state`` fetches ``status,resolution`` and ``transition_to_wont_do`` now short-circuits when ``statusCategory.key == "done"`` AND ``resolution.name`` is a Won't-Do name. Matches the common Atlassian workflow shape. * **#4 Raw comment body** — comments are wrapped in ADF via the new ``_wrap_text_as_adf`` helper. Atlassian REST API v3 rejects plain strings for issue-comment bodies. * **#5 ``get_epic_apply`` swallowing errors** — malformed JSON / failed Pydantic validation now log a structured ``epic_apply_artifact_invalid`` warning. Apply step's "no prior artifact" path still sees ``None``, but operators see the corruption. * **#6 Mutual-exclusivity validator** — Pipeline ``@model_validator`` refuses to construct a pipeline with both ``jira_ticket`` and ``jira_epic_key`` set. * **#7 Lossy description hash** — new ``compute_description_sha256`` hashes canonical ADF (`json.dumps(sort_keys=True, separators=(",", ":"))`) for dicts and UTF-8 for strings. The refine input gatherer now uses this helper. * **#9 Audit log holes** — every transition exit path emits an ``orch_jira_transition_attempt`` line with ``outcome=`` matching the path: ``credentials_unavailable``, ``feature_flag_disabled``, ``status_fetch_failed``, ``already_in_state``, ``transition_not_found``, ``post_failed``, ``applied``. * **#10 Feature-flag enforcement** — ``_post_transition`` checks the flag too (defence-in-depth). Future callers that go directly to the private method can't bypass the opt-in. * **#11 ``httpx.Client`` never closed** — new ``close()`` method plus ``__enter__``/``__exit__`` so the orchestrator's shutdown hook can release pooled connections. * **#12 ``__repr__`` token leak** — ``JiraCredentials.api_token`` is now declared with ``field(repr=False)``; ``repr(creds)`` emits ``JiraCredentials(base_url='...', username='...')`` only. reviewer_code v4 BLOCKER N1 — agent-outputs file consumer: * New module ``orchestrator/epic_apply_merge.py`` exporting ``merge_epic_apply_from_agent_outputs(pipeline, ...)``. Reads ``.egg-state/agent-outputs/<prefix>-epic-apply.json``, validates against the ``EpicApplyArtifact`` schema, and merges into ``pipeline.set_epic_apply()``. Re-runs union by ``(kind, target, summary_hash)`` for ``applied_edits`` and by ``child_key`` for ``wont_do_batch`` / ``in_flight_gates`` so partial-batch state survives re-spawns. * Wired into the phase-success path in ``orchestrator/routes/pipelines.py`` so refine and plan completions automatically merge the agent's artifact. ``make lint`` passes end-to-end. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps astral-sh/setup-uv from 4 to 7.
Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
803947bchore: update known checksums for 0.9.28 (#744)24553acchore: update known checksums for 0.9.27 (#742)085087aBump zizmorcore/zizmor-action from 0.3.0 to 0.4.1 (#741)9cfd029chore: update known checksums for 0.9.26 (#734)dd9d55bchore: update known checksums for 0.9.25 (#733)8512ad0Clarify impact of using actions/setup-python (#732)cc55817chore: update known checksums for 0.9.24 (#730)61cb8a9add outputs python-version and python-cache-hit (#728)11050edfix: use uv_build backend for old-python-constraint-project (#729)1d22fafBump peter-evans/create-pull-request from 7.0.9 to 8.0.0 (#719)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)