t1412.4: recover closed PR #3098 runtime task scanning#4135
t1412.4: recover closed PR #3098 runtime task scanning#4135marcusquinn merged 3 commits intomainfrom
Conversation
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughAdds pre-dispatch runtime content scanning to the cron-dispatch script using a configurable external helper; introduces Changes
Sequence DiagramsequenceDiagram
participant CD as Cron Dispatch
participant CSH as Content Scanner Helper
participant Task as Task Input
CD->>CD: Check WORKER_CONTENT_SCANNING && helper executable
alt Scanning enabled & helper present
CD->>CSH: Run scanner (scan-stdin) with Task
CSH-->>CD: Exit code + output
alt Exit 0
CD->>CD: log clean scan
CD->>Task: dispatch original task
else Exit 1 or 2
CD->>CD: log flagged/warn output
CD->>Task: annotate/wrap as untrusted (severity based)
else Other exit code
CD->>CD: log scan failure + output
CD->>Task: prefix with [UNSCANNED]
end
else Scanning enabled but helper missing OR scanning disabled
CD->>CD: log helper missing or disabled
CD->>Task: prefix with [UNSCANNED]
end
CD->>CD: Continue dispatch flow
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Wed Mar 11 14:40:27 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request recovers and enhances the worker-pipeline behavior from a previously closed pull request by adding content scanning to task descriptions before dispatch. This ensures that potentially malicious or untrusted content is identified and handled appropriately, with detailed logging for security auditing. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.agents/scripts/cron-dispatch.sh:
- Around line 331-355: The branch currently treats any scan_exit==1 as flagged;
instead, when CONTENT_SCANNER_HELPER scan-stdin returns exit 1, inspect
scan_result for an explicit scanner "flag" indicator (e.g., known token/keyword
the helper emits for FLAGGED or WARN) and only proceed with the flagged/warn
handling (the severity_label, annotate-stdin call, and wrapping into task) if
that marker is present; otherwise treat it as a scanner failure and follow the
UNSCANNED path (log the error and prepend the Runtime content scan failed
warning). Use the existing symbols scan_exit, scan_result,
CONTENT_SCANNER_HELPER scan-stdin, annotate-stdin, and task to implement this
conditional check.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 96eed225-b047-477f-821c-29f2e3dc404b
📒 Files selected for processing (1)
.agents/scripts/cron-dispatch.sh
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request reintroduces runtime task scanning before dispatch, a critical security feature. No new vulnerabilities were identified by the security review. The implementation is robust, handling various outcomes from the scanner including clean, flagged, and error states, and includes a new log_warn function for better logging. There is a suggestion to improve the robustness and clarity of how the scanner's output and exit code are captured, by using a more modern bash approach.
| local scan_result="" | ||
| local scan_exit=0 | ||
| scan_result=$(printf '%s' "$task" | CONTENT_SCANNER_QUIET=true "$CONTENT_SCANNER_HELPER" scan-stdin 2>&1) || scan_exit=$? |
There was a problem hiding this comment.
The current method of capturing the exit code using ... || scan_exit=$? is a common but sometimes fragile idiom in shell scripting, especially if set -e were to be used. A more robust and modern approach in bash is to use process substitution with read to capture the output, and PIPESTATUS to capture the exit code of commands in a pipeline. This separates the concerns of capturing output and exit status, leading to clearer and more reliable code, aligning with the principle of robust exit code handling as described in our guidelines (Rule 4).
| local scan_result="" | |
| local scan_exit=0 | |
| scan_result=$(printf '%s' "$task" | CONTENT_SCANNER_QUIET=true "$CONTENT_SCANNER_HELPER" scan-stdin 2>&1) || scan_exit=$? | |
| local scan_result scan_exit | |
| read -r -d '' scan_result < <(printf '%s' "$task" | CONTENT_SCANNER_QUIET=true "$CONTENT_SCANNER_HELPER" scan-stdin 2>&1) | |
| scan_exit=${PIPESTATUS[1]} |
References
- In shell scripts, capture a command's exit code in a variable instead of using
$?directly in conditionals. This aligns with ShellCheck SC2181 and improves clarity for multi-way branches.
|
Dispatching worker to address requested review changes.\n- Model: default headless rotation (anthropic/claude-sonnet-4-6 or openai/gpt-5.3-codex)\n- Branch: bugfix/pr3098-recovery\n- Scope: resolve CHANGES_REQUESTED feedback on runtime task scanning recovery PR\n- Attempt: 1 of 1\n- Direction: implement reviewer-requested deltas only and re-verify related checks |
|
Dispatching fix worker.
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Wed Mar 11 16:42:58 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
Missing issue link. This PR references issue #2645, but the PR body doesn't contain a closing keyword. Add |
|
Supervisor restarted the worker after a stalled run.
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Wed Mar 11 16:50:55 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
|
Detected unresolved inline bot suggestion(s). Dispatching a focused fix worker to evaluate and apply valid suggestions before merge. |
1 participant
Summary
cron-dispatch.shcontent-scanner-helper.shbefore dispatch and branch on outcomes: clean, flagged/warn (wrap as untrusted data), and scanner-failed/unavailable (prepend UNSCANNED warning)Why
PR #3098 was closed unmerged, and its key pipeline behavior (scanning task descriptions before dispatch) was not present on
main. This restores that safety control using the current scanner helper architecture already merged onmain.Verification
shellcheck .agents/scripts/cron-dispatch.sh(SC1091 info only; no warnings/errors).agents/scripts/content-scanner-helper.sh test(23 passed, 0 failed)scan-stdin=>CLEAN(exit 0)scan-stdin=>FLAGGED(exit 1)annotate-stdinemits[UNTRUSTED-DATA-{id}]...[/UNTRUSTED-DATA-{id}]Linkage
Summary by CodeRabbit