Add AGENTS.md for dev environment setup - #1
Draft
TheEvalon wants to merge 1 commit into
Draft
Conversation
Co-authored-by: TheEvalon <TheEvalon@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
May 10, 2026
#1 (HIGH) — import_bundle FK ordering. Folders were inserted before credential_profiles, but folders.default_credential_id FKs to credential_profiles(id) and the pool runs with foreign_keys=ON. Real exports where a folder has a default_credential_id failed FK validation. The same hazard applies to folder parent_id chains (a child folder exported before its parent). Fix: run the whole import inside one transaction with PRAGMA defer_foreign_keys = ON and use INSERT OR IGNORE for idempotent duplicate-skipping. All reads/writes go through the transaction, so the import works on test pools with max_connections=1 too. Counts come from rows_affected() rather than pre-checks. New regression tests: - import_with_folder_referencing_credential_in_same_bundle (the exact Bugbot scenario) - import_with_unsorted_folder_parents_succeeds (child-before-parent ordering) #2 (MEDIUM) — validate_relative_path false positives. p.contains("..") rejected legal filenames like 'backup..tar.gz', 'archive..2024.zip', 'my..folder'. Replaced with a path-component split on / and \ that flags only standalone '..' segments. Test coverage expanded: explicit OK cases for '..'-containing names, explicit error cases for traversal segments at every position. #3 (MEDIUM) — Vault::delete didn't gate on unlock. Adding require_unlocked() at the top brings it in line with put/get and preserves the invariant that all mutations require an unlocked vault. New regression test: - delete_requires_unlocked: confirms VaultLocked is returned and the ciphertext survives. 24 unit tests passing (up from 21). Clippy/fmt clean, npm lint/typecheck/build clean. Co-authored-by: TheEvalon <TheEvalon@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
AGENTS.mdwith Cursor Cloud specific instructions documenting that this is currently an empty repository with no applications, services, or dependencies to set up.When application code is added to this repo,
AGENTS.mdshould be updated with build, lint, test, and run instructions.