Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
7ebf177
feat(docker): add Phase 1 Docker configuration and scripts
unclesp1d3r Feb 11, 2026
5e5c8ab
fix(docker): address PR review feedback
unclesp1d3r Feb 11, 2026
bd19ede
fix(docker): address CodeRabbit nitpicks
unclesp1d3r Feb 11, 2026
c47a563
feat(control-api): implement hash list CRUD endpoints (T3)
unclesp1d3r Feb 11, 2026
895bc81
feat(control-api): implement resource file CRUD endpoints (T4)
unclesp1d3r Feb 11, 2026
5b23496
feat(control-api): implement presigned upload workflow (T5)
unclesp1d3r Feb 11, 2026
de9ef42
test(control-api): add tests for resource cleanup job (T6)
unclesp1d3r Feb 11, 2026
2fe797e
feat(control-api): implement campaign CRUD and validation endpoints (T7)
unclesp1d3r Feb 11, 2026
80825ff
feat(control-api): implement campaign lifecycle actions (T8)
unclesp1d3r Feb 11, 2026
7a18a99
feat(control-api): implement attack CRUD and validation endpoints (T9)
unclesp1d3r Feb 11, 2026
2d1b599
feat(control-api): implement attack lifecycle and reordering endpoint…
unclesp1d3r Feb 11, 2026
b84d658
feat(control-api): implement campaign progress and metrics endpoints …
unclesp1d3r Feb 11, 2026
0fa3e4c
feat(control-api): implement agent and task monitoring endpoints (T12)
unclesp1d3r Feb 11, 2026
1697ca1
feat(control-api): add hash item listing and hash list export endpoin…
unclesp1d3r Feb 11, 2026
f487617
feat(control-api): add template export endpoints for campaigns and at…
unclesp1d3r Feb 11, 2026
2c12935
Merge branch 'main' into 110-phase-1-docker-configuration-structure-a…
unclesp1d3r May 5, 2026
749c307
fix(pre-commit): format arguments and update dependencies in pre-comm…
unclesp1d3r May 5, 2026
b642a04
feat(config): add initial configuration for tessl MCP server
unclesp1d3r May 5, 2026
2a8ec65
feat(config): add settings configuration for tessl MCP server
unclesp1d3r May 5, 2026
70869f5
fix(pre-commit): add missing types for various hooks in configuration
unclesp1d3r May 5, 2026
ff57d34
feat(config): add initial MCP server configuration for tessl
unclesp1d3r May 5, 2026
2f56455
feat(policy): add AI usage policy to ensure accountability and unders…
unclesp1d3r May 5, 2026
1aefe5f
feat(config): update tool versions and add new settings for enhanced …
unclesp1d3r May 5, 2026
1d62c3b
feat(config): update language server list and improve configuration d…
unclesp1d3r May 5, 2026
6af1426
Refactor code structure for improved readability and maintainability
unclesp1d3r May 5, 2026
364819f
feat(justfile): integrate mise for improved tool management and strea…
unclesp1d3r May 5, 2026
723f589
Implement feature X to enhance user experience and fix bug Y in module Z
unclesp1d3r May 5, 2026
ef912f6
update uv.lock
unclesp1d3r May 5, 2026
8d897cb
feat(tessl): add initial configuration file with dependencies for sec…
unclesp1d3r May 5, 2026
7d51adf
feat(gitignore): update .gitignore to include local configurations an…
unclesp1d3r May 5, 2026
3367965
feat(config): add example local configuration file for Compound Engin…
unclesp1d3r May 5, 2026
1734733
fix(tasks): correct exception handling for TaskNotFoundError and Agen…
unclesp1d3r May 5, 2026
bcd95e9
feat(oxlint): update configuration to re-enable settings and adjust r…
unclesp1d3r May 5, 2026
fd46982
fix: update exception handling to remove parentheses for multiple exc…
unclesp1d3r May 5, 2026
7f951d4
refactor: replace Enum with StrEnum for consistency across models and…
unclesp1d3r May 5, 2026
5f09e31
refactor: simplify Use lambda functions in factory definitions
unclesp1d3r May 5, 2026
e2a5842
fix(ci): resolve lint and e2e failures
unclesp1d3r May 5, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .bun-version
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
1.3.13
4 changes: 4 additions & 0 deletions .codex/config.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[mcp_servers.tessl]
type = "stdio"
command = "tessl"
args = [ "mcp", "start" ]
31 changes: 31 additions & 0 deletions .compound-engineering/config.local.example.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# Compound Engineering -- local config
# Copy to .compound-engineering/config.local.yaml in your project root.
# All settings are optional. Invalid values fall through to defaults.

# --- Work delegation (Codex) ---

# work_delegate: codex # codex | false (default: false)
# work_delegate_consent: true # true | false (default: false)
# work_delegate_sandbox: yolo # yolo | full-auto (default: yolo)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Clarify sandbox security implications and reconsider "yolo" naming.

The work_delegate_sandbox: yolo example uses slang that suggests recklessness in a security-sensitive context. Even as example documentation, "yolo" undermines the seriousness of sandbox isolation controls.

Additionally, the options yolo | full-auto are not explained—users cannot assess the security tradeoffs between these modes. Consider:

  • Replacing "yolo" with a more descriptive term (e.g., interactive, manual-confirm)
  • Adding brief inline comments explaining the security posture of each mode
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.compound-engineering/config.local.example.yaml at line 9, Replace the
informal value name and add inline security comments for the
work_delegate_sandbox config key: change the example value from "yolo" to a
clearer option such as "interactive" or "manual-confirm", add the allowed values
(e.g., interactive | full-auto) and annotate each option with a brief comment
describing its security posture (e.g., "interactive — requires manual
confirmation, safest" and "full-auto — executes without manual checks, higher
risk"), and update the example line for work_delegate_sandbox to use the new
descriptive value and comments so users can understand the tradeoffs.

# work_delegate_decision: auto # auto | ask (default: auto)
# work_delegate_model: gpt-5.4 # any valid codex model (omit to use ~/.codex/config.toml default)
# work_delegate_effort: high # minimal | low | medium | high | xhigh (omit to use ~/.codex/config.toml default)

# --- Product pulse ---
# Settings written by /ce-product-pulse first-run interview. Re-run the skill with
# argument `setup` or `reconfigure` to edit interactively.

# pulse_product_name: "Spiral" # used in report titles (no default)
# pulse_lookback_default: 24h # 1h | 24h | 7d | 30d (default: 24h)
# pulse_primary_event: "session_started" # the event that means "user showed up"
# pulse_value_event: "task_completed" # the event that means "user got value"
# pulse_completion_events: "onboarded,first_purchase" # comma-separated, 0-3 events
# pulse_quality_scoring: false # true | false (default: false; AI products only)
# pulse_quality_dimension: "answer accuracy" # dimension scored 1-5 when pulse_quality_scoring is true
# pulse_analytics_source: posthog # posthog | mixpanel | custom (no default)
# pulse_tracing_source: sentry # sentry | datadog | custom (no default)
# pulse_payments_source: stripe # stripe | custom (no default)
# pulse_db_enabled: false # true | false (default: false; read-only DB if true)
Comment on lines +25 to +28

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Add security guidance for external service integration.

Lines 25–28 demonstrate integration with external services (PostHog, Sentry, Stripe) and optional database access, but provide no guidance on secure credential management. Users copying this template may inadvertently hardcode API keys or connection strings.

Consider adding a comment block above these lines noting:

  • Whether config.local.yaml should be gitignored
  • How/where to store API keys and secrets (e.g., environment variables, secret management service)
  • Security implications of enabling database access (pulse_db_enabled)
🛡️ Example security guidance addition
+# SECURITY: Keep API keys and database credentials out of this file.
+# Use environment variables or a secrets manager. Ensure config.local.yaml is gitignored.
+
 # pulse_analytics_source: posthog                       # posthog | mixpanel | custom (no default)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# pulse_analytics_source: posthog # posthog | mixpanel | custom (no default)
# pulse_tracing_source: sentry # sentry | datadog | custom (no default)
# pulse_payments_source: stripe # stripe | custom (no default)
# pulse_db_enabled: false # true | false (default: false; read-only DB if true)
# SECURITY: Keep API keys and database credentials out of this file.
# Use environment variables or a secrets manager. Ensure config.local.yaml is gitignored.
# pulse_analytics_source: posthog # posthog | mixpanel | custom (no default)
# pulse_tracing_source: sentry # sentry | datadog | custom (no default)
# pulse_payments_source: stripe # stripe | custom (no default)
# pulse_db_enabled: false # true | false (default: false; read-only DB if true)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.compound-engineering/config.local.example.yaml around lines 25 - 28, Add a
short security guidance comment block above the pulse_analytics_source,
pulse_tracing_source, pulse_payments_source and pulse_db_enabled lines: state
that config.local.yaml should be added to .gitignore, instruct to never hardcode
API keys or DB credentials in this file and instead load them from environment
variables or a secrets manager (e.g., AWS Secrets Manager, Vault), show examples
of using env var names (not values), and warn about the risks of enabling
pulse_db_enabled (read-only DB exposure and principle of least privilege).
Reference the specific keys pulse_analytics_source, pulse_tracing_source,
pulse_payments_source and pulse_db_enabled so maintainers know where to place
the guidance.

# pulse_metric_sources: "retention_d7=posthog,nps=delighted" # strategy-metric -> source overrides; comma-separated 'metric=source' pairs; unlisted metrics fall back to pulse_analytics_source
# pulse_pending_metrics: "retention_d7,nps" # comma-separated strategy metrics awaiting instrumentation; render as 'no data'
# pulse_excluded_metrics: "north_star" # comma-separated strategy metrics intentionally not in pulse
12 changes: 12 additions & 0 deletions .gemini/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"mcpServers": {
"tessl": {
"type": "stdio",
"command": "tessl",
"args": [
"mcp",
"start"
]
}
}
}
21 changes: 21 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -131,3 +131,24 @@ vite.config.ts.timestamp-*
frontend/test-artifacts/*
.commitizen/openai_cache.json
.github/skills/*

**/*.local.*

# Re-include CE example configs (committed for teammates to see available settings)
!.compound-engineering/*.example.yaml

# AI coding assistants (local state, not shared)
docs/plans/
.agent/
.agents/
.augment/
.claude/
.context/
.cursor/
.roo/
.full-review/
SECURITY_AUDIT.md

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not ignore SECURITY_AUDIT.md.

Line 150 prevents security-audit evidence from being versioned/reviewed, which weakens remediation traceability.

Suggested change
-SECURITY_AUDIT.md
+# Keep audit reports visible in VCS; ignore only local drafts if needed:
+# SECURITY_AUDIT.local.md
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
SECURITY_AUDIT.md
# Keep audit reports visible in VCS; ignore only local drafts if needed:
# SECURITY_AUDIT.local.md
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitignore at line 150, The .gitignore currently excludes SECURITY_AUDIT.md
which prevents security-audit evidence from being committed; remove the
"SECURITY_AUDIT.md" entry (or comment it out) from .gitignore so the
SECURITY_AUDIT.md file is tracked and can be versioned/reviewed, then commit the
updated .gitignore and add SECURITY_AUDIT.md to the repo so audit artifacts are
preserved.

todos/
**/tessl__*
.tessl/tiles/
.tessl/RULES.md
12 changes: 12 additions & 0 deletions .mcp.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"mcpServers": {
"tessl": {
"type": "stdio",
"command": "tessl",
"args": [
"mcp",
"start"
]
}
}
}
30 changes: 21 additions & 9 deletions .pre-commit-config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,52 +6,64 @@ repos:
rev: v6.0.0
hooks:
- id: check-added-large-files
args: ["--maxkb=1024"]
args: [ "--maxkb=1024" ]
- id: check-ast
- id: check-case-conflict
- id: check-merge-conflict
- id: check-illegal-windows-names
- id: check-json
types: [ json ]
- id: check-toml
types: [ toml ]
- id: check-yaml
args: [--unsafe]
types: [ yaml ]
args: [ --unsafe ]
- id: check-xml
types: [ xml ]
- id: mixed-line-ending
args: [--fix=auto]
types: [ text ]
args: [ --fix=auto ]
- id: check-docstring-first
types: [ python ]
Comment on lines +9 to +27

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Normalize the inline list spacing before merge.

yamllint is already flagging each modified [ ... ] entry under the brackets rule, so this config will fail the repo's pre-commit checks as written.

As per coding guidelines, ".pre-commit-config.yaml: Run checks via pre-commit before committing code".

Also applies to: 35-38, 44-45, 52-52, 58-58, 66-66, 83-83

🧰 Tools
🪛 YAMLlint (1.38.0)

[error] 9-9: too many spaces inside brackets

(brackets)


[error] 9-9: too many spaces inside brackets

(brackets)


[error] 15-15: too many spaces inside brackets

(brackets)


[error] 15-15: too many spaces inside brackets

(brackets)


[error] 17-17: too many spaces inside brackets

(brackets)


[error] 17-17: too many spaces inside brackets

(brackets)


[error] 19-19: too many spaces inside brackets

(brackets)


[error] 19-19: too many spaces inside brackets

(brackets)


[error] 20-20: too many spaces inside brackets

(brackets)


[error] 20-20: too many spaces inside brackets

(brackets)


[error] 22-22: too many spaces inside brackets

(brackets)


[error] 22-22: too many spaces inside brackets

(brackets)


[error] 24-24: too many spaces inside brackets

(brackets)


[error] 24-24: too many spaces inside brackets

(brackets)


[error] 25-25: too many spaces inside brackets

(brackets)


[error] 25-25: too many spaces inside brackets

(brackets)


[error] 27-27: too many spaces inside brackets

(brackets)


[error] 27-27: too many spaces inside brackets

(brackets)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.pre-commit-config.yaml around lines 9 - 27, The inline YAML lists use
spaced bracket style that yamllint's brackets rule flags; update each inline
list to the compact form (remove the spaces inside brackets) so they pass
linting: replace occurrences like args: [ "--maxkb=1024" ], types: [ json ],
args: [ --unsafe ], args: [ --fix=auto ], and types: [ python ] with compact
equivalents (e.g. args:["--maxkb=1024"], types:[json], args:[--unsafe],
args:[--fix=auto], types:[python]) consistently across the shown entries and the
other locations called out (lines referenced in the comment).

- id: check-vcs-permalinks

# 🧹 Ruff linting + formatting
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.14.14
rev: v0.15.12 # v0.15.12
hooks:
- id: ruff-check
args: [--fix]
args: [ --fix ]
types: [ python ]
- id: ruff-format
types: [ python ]

- repo: https://github.com/asottile/pyupgrade
rev: v3.21.2
hooks:
- id: pyupgrade
args: ["--py314-plus"]
args: [ "--py314-plus" ]
types: [ python ]

- repo: https://github.com/rhysd/actionlint
rev: v1.7.10
rev: v1.7.12 # v1.7.12
hooks:
- id: actionlint
files: ".github/workflows/"
types: [ yaml ]

- repo: https://github.com/koalaman/shellcheck-precommit
rev: v0.11.0
hooks:
- id: shellcheck
types: [ shell ]

# 🐍 uv for Python environment management
- repo: https://github.com/astral-sh/uv-pre-commit
rev: 0.9.26
rev: 0.11.8 # 0.11.8
hooks:
- id: uv-lock
files: ^(.*/)?(pyproject\.toml|uv\.lock)$
types: [ toml ]

- repo: https://github.com/executablebooks/mdformat
rev: 1.0.0
Expand All @@ -68,4 +80,4 @@ repos:
- mdformat-gfm-alerts
- mdformat-toc
- mdformat-front-matters
types: [markdown]
types: [ markdown ]
171 changes: 111 additions & 60 deletions .serena/project.yml
Original file line number Diff line number Diff line change
@@ -1,90 +1,141 @@


Comment on lines +1 to +2

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix YAMLlint failure from extra leading blank line.

Line 2 creates consecutive blank lines at the top of the file, and YAMLlint flags this as empty-lines. Remove one blank line to keep lint checks stable.

Suggested diff
-
-
 # list of languages for which language servers are started; choose from:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# list of languages for which language servers are started; choose from:
🧰 Tools
🪛 YAMLlint (1.38.0)

[error] 2-2: too many blank lines (2 > 0)

(empty-lines)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.serena/project.yml around lines 1 - 2, Remove the extra leading blank line
at the top of project.yml so there are no consecutive empty lines (delete the
second blank line so the file begins immediately or with a single allowed
newline), ensuring the YAML has no top-of-file empty-lines lint error.

# list of languages for which language servers are started; choose from:
# al bash clojure cpp csharp csharp_omnisharp
# dart elixir elm erlang fortran fsharp
# go groovy haskell java julia kotlin
# lua markdown nix pascal perl php
# powershell python python_jedi r rego ruby
# ruby_solargraph rust scala swift terraform toml
# typescript typescript_vts yaml zig
# al ansible bash clojure cpp
# cpp_ccls crystal csharp csharp_omnisharp dart
# elixir elm erlang fortran fsharp
# go groovy haskell haxe hlsl
# java json julia kotlin lean4
# lua luau markdown matlab msl
# nix ocaml pascal perl php
# php_phpactor powershell python python_jedi python_ty
# r rego ruby ruby_solargraph rust
# scala solidity swift systemverilog terraform
# toml typescript typescript_vts vue yaml
# zig
# (This list may be outdated. For the current list, see values of Language enum here:
# https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
# For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
# Note:
# - For C, use cpp
# - For JavaScript, use typescript
# - For Free Pascal / Lazarus, use pascal
# - For Free Pascal/Lazarus, use pascal
# Special requirements:
# - csharp: Requires the presence of a .sln file in the project folder.
# - pascal: Requires Free Pascal Compiler (fpc) and optionally Lazarus.
# Some languages require additional setup/installations.
# See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
# When using multiple languages, the first language server that supports a given file will be used for that file.
# The first language is the default language and the respective language server will be used as a fallback.
# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
languages:
- typescript
- vue
- python
- bash
- typescript
- vue
- python
- bash

# the encoding used by text files in the project
# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
encoding: "utf-8"

# whether to use the project's gitignore file to ignore files
# Added on 2025-04-07
# whether to use project's .gitignore files to ignore files
ignore_all_files_in_gitignore: true

# list of additional paths to ignore
# same syntax as gitignore, so you can use * and **
# Was previously called `ignored_dirs`, please update your config if you are using that.
# Added (renamed) on 2025-04-07
# list of additional paths to ignore in this project.
# Same syntax as gitignore, so you can use * and **.
# Note: global ignored_paths from serena_config.yml are also applied additively.
ignored_paths: []

# whether the project is in read-only mode
# If set to true, all editing tools will be disabled and attempts to use them will result in an error
# Added on 2025-04-18
read_only: false

# list of tool names to exclude. We recommend not excluding any tools, see the readme for more details.
# Below is the complete list of tools for convenience.
# To make sure you have the latest list of tools, and to view their descriptions,
# execute `uv run scripts/print_tool_overview.py`.
#
# * `activate_project`: Activates a project by name.
# * `check_onboarding_performed`: Checks whether project onboarding was already performed.
# * `create_text_file`: Creates/overwrites a file in the project directory.
# * `delete_lines`: Deletes a range of lines within a file.
# * `delete_memory`: Deletes a memory from Serena's project-specific memory store.
# * `execute_shell_command`: Executes a shell command.
# * `find_referencing_code_snippets`: Finds code snippets in which the symbol at the given location is referenced.
# * `find_referencing_symbols`: Finds symbols that reference the symbol at the given location (optionally filtered by type).
# * `find_symbol`: Performs a global (or local) search for symbols with/containing a given name/substring (optionally filtered by type).
# * `get_current_config`: Prints the current configuration of the agent, including the active and available projects, tools, contexts, and modes.
# * `get_symbols_overview`: Gets an overview of the top-level symbols defined in a given file.
# * `initial_instructions`: Gets the initial instructions for the current project.
# Should only be used in settings where the system prompt cannot be set,
# e.g. in clients you have no control over, like Claude Desktop.
# * `insert_after_symbol`: Inserts content after the end of the definition of a given symbol.
# * `insert_at_line`: Inserts content at a given line in a file.
# * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol.
# * `list_dir`: Lists files and directories in the given directory (optionally with recursion).
# * `list_memories`: Lists memories in Serena's project-specific memory store.
# * `onboarding`: Performs onboarding (identifying the project structure and essential tasks, e.g. for testing or building).
# * `prepare_for_new_conversation`: Provides instructions for preparing for a new conversation (in order to continue with the necessary context).
# * `read_file`: Reads a file within the project directory.
# * `read_memory`: Reads the memory with the given name from Serena's project-specific memory store.
# * `remove_project`: Removes a project from the Serena configuration.
# * `replace_lines`: Replaces a range of lines within a file with new content.
# * `replace_symbol_body`: Replaces the full definition of a symbol.
# * `restart_language_server`: Restarts the language server, may be necessary when edits not through Serena happen.
# * `search_for_pattern`: Performs a search for a pattern in the project.
# * `summarize_changes`: Provides instructions for summarizing the changes made to the codebase.
# * `switch_modes`: Activates modes by providing a list of their names
# * `think_about_collected_information`: Thinking tool for pondering the completeness of collected information.
# * `think_about_task_adherence`: Thinking tool for determining whether the agent is still on track with the current task.
# * `think_about_whether_you_are_done`: Thinking tool for determining whether the task is truly completed.
# * `write_memory`: Writes a named memory (for future reference) to Serena's project-specific memory store.
# list of tool names to exclude.
# This extends the existing exclusions (e.g. from the global configuration)
# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
excluded_tools: []

# initial prompt for the project. It will always be given to the LLM upon activating the project
# (contrary to the memories, which are loaded on demand).
initial_prompt: ""

# the name by which the project can be referenced within Serena
project_name: "Ouroboros"

# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
# This extends the existing inclusions (e.g. from the global configuration).
# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
included_optional_tools: []

# list of mode names to that are always to be included in the set of active modes
# The full set of modes to be activated is base_modes + default_modes.
# If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply.
# Otherwise, this setting overrides the global configuration.
# Set this to [] to disable base modes for this project.
# Set this to a list of mode names to always include the respective modes for this project.
base_modes:

Comment on lines +74 to +75

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

In Serena project.yml configuration, how are base_modes, default_modes, and added_modes interpreted when the key is present with no value (YAML null)? Does this behave like "unset/inherit global config", or does it override global settings?

💡 Result:

If the keys base_modes, default_modes, or added_modes are present in .serena/project.yml but have YAML null (e.g., base_modes: null / base_modes: with an empty value), Serena treats that as “this setting is specified in the project config, so it overrides the global config” rather than “unset/inherit global”. - base_modes: Serena docs state that when this setting is undefined (i.e., not present), it uses the global base_modes; otherwise (when set in the project config) it overrides the global configuration [1]. Therefore, explicitly setting it to null in YAML counts as being present/set, so it will not inherit the global base_modes. - default_modes: Serena docs state the same override rule: if default_modes is undefined, it uses global default_modes; otherwise, the project’s default_modes overrides the global config [1]. Therefore, an explicit YAML null in default_modes will not inherit the global default_modes. - added_modes: Serena docs describe added_modes as “added on top” from the project configuration (and/or via CLI) and that it contributes via union with the other mode sets [2]. The same principle applies: a project-provided value affects the computed active modes instead of leaving things to global defaults. In short: these keys only inherit global settings when they are truly “undefined/missing”; putting them in project.yml with a null value is interpreted as explicitly overriding the corresponding global settings, not as inheriting them [1][2].

Citations:


Remove null mode settings or set explicit values; they override global configuration.

Lines 74, 84, and 130 define mode keys with empty values (null), which explicitly override corresponding global settings in Serena rather than inheriting them. For clarity and intent:

  • To inherit global behavior: Remove these keys entirely from the project config
  • To enforce empty modes: Use [] instead of null
  • To specify modes: Provide concrete mode lists

This prevents accidental configuration overrides that mask global settings.

Also applies to: 84-85, 130-131

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.serena/project.yml around lines 74 - 75, The project YAML contains mode
keys set to null (notably base_modes and the other mode keys referenced in the
file) which unintentionally override global Serena settings; fix by removing
those null keys to inherit globals, or change them to explicit empty lists ([])
to enforce no modes, or replace with concrete mode lists to enforce specific
modes—update the base_modes key and the other empty mode keys in the file
accordingly.

# list of mode names that are to be activated by default, overriding the setting in the global configuration.
# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
# If the setting is undefined/empty, the default_modes from the global configuration (serena_config.yml) apply.
# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
# Therefore, you can set this to [] if you do not want the default modes defined in the global config to apply
# for this project.
# This setting can, in turn, be overridden by CLI parameters (--mode).
# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
default_modes:

# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
# This cannot be combined with non-empty excluded_tools or included_optional_tools.
# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
fixed_tools: []

# time budget (seconds) per tool call for the retrieval of additional symbol information
# such as docstrings or parameter information.
# This overrides the corresponding setting in the global configuration; see the documentation there.
# If null or missing, use the setting from the global configuration.
symbol_info_budget:

# The language backend to use for this project.
# If not set, the global setting from serena_config.yml is used.
# Valid values: LSP, JetBrains
# Note: the backend is fixed at startup. If a project with a different backend
# is activated post-init, an error will be returned.
language_backend:

# list of regex patterns which, when matched, mark a memory entry as read‑only.
# Extends the list from the global configuration, merging the two lists.
read_only_memory_patterns: []

# line ending convention to use when writing source files.
# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
line_ending:

# list of regex patterns for memories to completely ignore.
# Matching memories will not appear in list_memories or activate_project output
# and cannot be accessed via read_memory or write_memory.
# To access ignored memory files, use the read_file tool on the raw file path.
# Extends the list from the global configuration, merging the two lists.
# Example: ["_archive/.*", "_episodes/.*"]
ignored_memory_patterns: []

# advanced configuration option allowing to configure language server-specific options.
# Maps the language key to the options.
# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available.
# No documentation on options means no options are available.
ls_specific_settings: {}

# list of mode names to be activated additionally for this project, e.g. ["query-projects"]
# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
added_modes:

# list of additional workspace folder paths for cross-package reference support (e.g. in monorepos).
# Paths can be absolute or relative to the project root.
# Each folder is registered as an LSP workspace folder, enabling language servers to discover
# symbols and references across package boundaries.
# Currently supported for: TypeScript.
# Example:
# additional_workspace_folders:
# - ../sibling-package
# - ../shared-lib
additional_workspace_folders: []
Loading
Loading