Skip to content

fix(AGE-65): address Copilot + Codex review feedback across PRs 62-85 - #88

Merged
LaloLalo1999 merged 12 commits into
mainfrom
fix/age-65-review-sweep
May 1, 2026
Merged

fix(AGE-65): address Copilot + Codex review feedback across PRs 62-85#88
LaloLalo1999 merged 12 commits into
mainfrom
fix/age-65-review-sweep

Conversation

@LaloLalo1999

@LaloLalo1999 LaloLalo1999 commented May 1, 2026

Copy link
Copy Markdown
Contributor

[AI review sweep]

Follow-up to automated review comments from copilot-pull-request-reviewer and chatgpt-codex-connector on merged PRs #62, #77, #78, #80, #81, #82, #83, #84, #85.

Changes by PR

PR #62

  • Validate source and externalRef in isBacklogIssueLike (Codex).

PR #77

  • Add MAX_BODY_BYTES (1MB) limit to verifyHmac to prevent DoS (Copilot).
  • Cache imported CryptoKey in signHmac to reduce per-request latency (Copilot).
  • Remove unused ExecRequest import from index.ts (Copilot).
  • Redact credentials from repoUrl in /git-clone response (Copilot).

PR #78

  • Fix design-system footer link to point at docs/design/design-system.html (Codex/Copilot).
  • Replace empty anchor <a id="top"> with <div aria-hidden> for a11y (Copilot).
  • Harden tweaks-panel postMessage to only accept from window.parent when embedded (Copilot).
  • Fix "Watch the demo" scroll targets from missing #demo to existing #vignette (Copilot).

PR #80

  • Add set -o pipefail to scripts/smoke.sh so pipeline failures are preserved (Codex/Copilot).

PR #81

  • Reject git --output= in runCommand allow-list (Codex).
  • Reject rg --pre= in runCommand allow-list (Codex).
  • Strip trailing slash from SANDBOX_RUNNER_URL in SandboxClient (Codex).

PR #83

  • Fail convex CI leg on push to main when CONVEX_DEPLOY_KEY is missing; fork PRs still skip gracefully (Codex).

PR #84

  • Encode cwd via URLSearchParams constructor instead of string interpolation (Codex).

PR #85

  • Replace incorrect npx convex run --version <prev> rollback command with accurate instructions (Codex).
  • Add continue-on-error: true to preview URL comment step so fork PRs do not fail the workflow (Codex).

Also included

  • Fix pre-existing lint warnings in alchemy/dns.ts (unused import, unused variable).

Deferred / non-actionable

  • Convex-component-related comments (streaming.ts, r2.ts, waitlist.ts, rateLimiter.ts, etc.) — handled by parallel subagent on AGE-63.
  • Alchemy IAC structural comments (CustomDomain shape, secret encryption, zoneId) — out of scope for review sweep; would require infra redesign.
  • Sandbox Dockerfile entrypoint — infrastructure/deployment issue, not a code fix.
  • Replay protection via nonce/DO cache — would require new infrastructure; timestamp skew is the current defense.
  • Missing endpoint-level tests for sandbox-runner — would require significant new test scaffolding; out of scope for sweep.
  • Landing CI integration (root lint/typecheck covering apps) — intentional design decision; each app has its own checks.
  • TanStack Start deferred-app comments — app deploy is intentionally deferred per project plan.
  • FreeLLM tunnel DNS placeholder — superseded by AGE-46 OpenRouter migration.

Copilot AI review requested due to automatic review settings May 1, 2026 05:31
@blocksorg

blocksorg Bot commented May 1, 2026

Copy link
Copy Markdown

Mention Blocks like a regular teammate with your question or request:

@blocks review this pull request
@blocks make the following changes ...
@blocks create an issue from what was mentioned in the following comment ...
@blocks explain the following code ...
@blocks are there any security or performance concerns?

Run @blocks /help for more information.

Workspace settings | Disable this message

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed May 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1c48894a29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread apps/sandbox-runner/src/auth.ts Outdated
@github-actions

github-actions Bot commented May 1, 2026

Copy link
Copy Markdown

Code Colony preview deployed for preview-88.

@LaloLalo1999
fix(AGE-65): address PR #62 review feedback
25c908a 
- Validate source and externalRef in isBacklogIssueLike (Codex review).

Addresses:
- #62 (comment)
@LaloLalo1999
fix(AGE-65): address PR #77 review feedback
17cbd83 
- Add MAX_BODY_BYTES (1MB) limit to verifyHmac to prevent DoS (Copilot).
- Cache imported CryptoKey in signHmac to reduce per-request latency (Copilot).
- Remove unused ExecRequest import from index.ts (Copilot).
- Redact credentials from repoUrl in /git-clone response (Copilot).

Addresses:
- #77 (comment)
- #77 (comment)
- #77 (comment)
- #77 (comment)
- #77 (comment)
@LaloLalo1999
fix(AGE-65): address PR #78 review feedback
0029862 
- Fix design-system footer link to point at docs/design/design-system.html (Codex/Copilot).
- Replace empty anchor <a id="top"> with <div aria-hidden> for a11y (Copilot).
- Harden tweaks-panel postMessage to only accept from window.parent when embedded (Copilot).
- Fix "Watch the demo" scroll targets from missing #demo to existing #vignette (Copilot).

Addresses:
- #78 (comment)
- #78 (comment)
- #78 (comment)
- #78 (comment)
- #78 (comment)
- #78 (comment)
@LaloLalo1999
fix(AGE-65): address PR #80 review feedback
3359070 
- Add `set -o pipefail` to scripts/smoke.sh so pipeline failures are preserved (Codex).

Addresses:
- #80 (comment)
- #80 (comment)
@LaloLalo1999
chore(AGE-65): fix pre-existing lint warnings in alchemy/dns.ts
2a9f896 
- Remove unused DnsRecords import.
- Suppress unused zone.id via void operator.
@LaloLalo1999
fix(AGE-65): address PR #81 review feedback
bf4677c 
- Reject git --output= in runCommand allow-list (Codex).
- Reject rg --pre= in runCommand allow-list (Codex).
- Strip trailing slash from SANDBOX_RUNNER_URL in SandboxClient (Codex).

Addresses:
- #81 (comment)
- #81 (comment)
- #81 (comment)
@LaloLalo1999
fix(AGE-65): address PR #83 review feedback
4b32682 
- Fail convex CI leg on push to main when CONVEX_DEPLOY_KEY is missing (Codex).
  Fork PRs still skip gracefully.

Addresses:
- #83 (comment)
@LaloLalo1999
fix(AGE-65): address PR #84 review feedback
f293023 
- Encode cwd via URLSearchParams constructor instead of string interpolation
  to correctly handle special characters in paths (Codex).

Addresses:
- #84 (comment)
@LaloLalo1999
fix(AGE-65): address PR #85 review feedback
668a70b 
- Replace incorrect `npx convex run --version <prev>` rollback command with
  accurate instructions (redeploy or dashboard promote) (Codex).
- Add `continue-on-error: true` to preview URL comment step so fork PRs
  with read-only tokens do not fail the workflow (Codex).

Addresses:
- #85 (comment)
- #85 (comment)
@LaloLalo1999
LaloLalo1999 force-pushed the fix/age-65-review-sweep branch from 6f165dd to 668a70b Compare May 1, 2026 05:45
@github-actions

github-actions Bot commented May 1, 2026

Copy link
Copy Markdown

Code Colony preview deployed for preview-88.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed May 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 668a70b2e4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread mastra/tools/runCommand.ts Outdated
Comment thread mastra/tools/runCommand.ts Outdated
Copilot AI reviewed May 1, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@LaloLalo1999
fix(AGE-65): use UTF-8 byte length for MAX_BODY_BYTES check
8fab22e 
body.length counts UTF-16 code units, so multi-byte UTF-8 payloads can
sneak past the 1MB cap while still exceeding it on the wire. Use
TextEncoder().encode(body).byteLength instead. Codex review feedback.
@github-actions

github-actions Bot commented May 1, 2026

Copy link
Copy Markdown

Code Colony preview deployed for preview-88.

@LaloLalo1999
fix(AGE-65): block --output and --pre in space-separated form too
41362e9 
Codex flagged P1: previous guards only matched '--output=' / '--pre=',
allowing 'git diff --output /tmp/pwn' and 'rg foo --pre touch' through.
Use a regex that matches either form. Added test cases.
@github-actions

github-actions Bot commented May 1, 2026

Copy link
Copy Markdown

Code Colony preview deployed for preview-88.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed May 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41362e9782

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread apps/landing/src/App.tsx
@LaloLalo1999
fix(AGE-65): restore hero-bg div removed by mistake (codex P2)
023de39 
The PR #78 review feedback only asked to replace the empty <a id="top">
anchor with an aria-hidden div. The previous commit also removed the
<div className="hero-bg"> background layer which landing.css's .hero-bg
and .hero-bg::before still target. Restore the div as aria-hidden so the
hero gradient/grid background renders again.
@github-actions

github-actions Bot commented May 1, 2026

Copy link
Copy Markdown

Code Colony preview deployed for preview-88.

@LaloLalo1999
LaloLalo1999 merged commit e73560b into main May 1, 2026
7 checks passed
@LaloLalo1999
LaloLalo1999 deleted the fix/age-65-review-sweep branch July 30, 2026 11:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@LaloLalo1999