Skip to content

[WRONG BRANCH] fix(kiro): preserve property names when flattening root composition #277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
luvs01 wants to merge 2 commits into
base: main
Choose a base branch
from
+49 −12
Draft

[WRONG BRANCH] fix(kiro): preserve property names when flattening root composition #277

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
63bfd14
docs(governance): move @Wibias to former maintainers (#2098)
lidge-jun Aug 19, 2026
75d2b6e
fix(kiro): preserve keyword-named composed properties
luvs01 Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# Default reviewers
* @lidge-jun @Ingwannu @Wibias
* @lidge-jun @Ingwannu

# High-impact runtime behavior
/src/adapters/ @lidge-jun @Ingwannu @Wibias
/src/providers/ @lidge-jun @Ingwannu @Wibias
/src/codex/ @lidge-jun @Ingwannu @Wibias
/src/server/ @lidge-jun @Ingwannu @Wibias
/src/adapters/ @lidge-jun @Ingwannu
/src/providers/ @lidge-jun @Ingwannu
/src/codex/ @lidge-jun @Ingwannu
/src/server/ @lidge-jun @Ingwannu

# Repository automation and release security
/.github/ @lidge-jun @Ingwannu
Expand Down
37 changes: 32 additions & 5 deletions MAINTAINERS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,23 @@ review and merge policy.
| --- | --- | --- |
| [@lidge-jun](https://github.com/lidge-jun) | Project owner | Project direction, releases, repository administration, and final governance decisions |
| [@Ingwannu](https://github.com/Ingwannu) | Maintainer | Issue and pull-request triage, `dev` integration, security review, and repository maintenance |
| [@Wibias](https://github.com/Wibias) | Maintainer | Issue and pull-request triage, `dev` integration, and provider/CI maintenance |

The table describes project responsibilities. Actual repository permissions remain controlled
through GitHub repository settings.

`dev` is the only integration line. The former `dev2-go` carry duty is retired;
see [The retired `dev2-go` line](#the-retired-dev2-go-line).

## Former maintainers

| GitHub account | Project role | Period |
| --- | --- | --- |
| [@Wibias](https://github.com/Wibias) | Maintainer | 2026-07-27 – 2026-08-19 |

Former maintainers keep contributor standing and are welcome to open issues and pull requests like
anyone else. Authorship credit in git history, release notes, and code comments is not rewritten
when a maintainer steps down.

## Review and merge policy

- Pull requests target `dev`. It is the only integration line, and promotion to
Expand Down Expand Up @@ -98,17 +107,35 @@ Adding or removing a maintainer requires:

### Change log

- 2026-08-19 — [@Wibias](https://github.com/Wibias) stepped down as a maintainer
and is now a contributor. This follows his own decision to stop developing
opencodex; it is not a disciplinary action, and it was made with the owner's
agreement (requirement 1). Requirement 2 does not apply to a maintainer's own
resignation, which needs no second maintainer to ratify it. Requirement 3 is
met by this file and `.github/CODEOWNERS`, where the default-reviewer line
and the four runtime paths that listed him (`/src/adapters/`,
`/src/providers/`, `/src/codex/`, `/src/server/`) drop back to the two
remaining maintainers. Repository permission was reduced to read access at
the same time, so the roster and the GitHub settings agree again.

Nothing he authored is being unwound. His commits, the pull requests he
merged, the release-note attributions, and the code comments citing his
reviews stay exactly as they are, and the trust-lane gate derived from his
work in `.github/scripts/pr-sponsored-surface.cjs` keeps its attribution.
Returning to the maintainer table later would go through the same three
requirements that govern every addition.

- 2026-07-27 — [@Wibias](https://github.com/Wibias) added as a maintainer.
Requirement 1 (agreement from the project owner) is met: the owner requested
the addition. **Requirement 2 (review by another current maintainer) was
never satisfied in the form this document describes.** The three commits that
carried the addition (`a2693c02`, `dc3a4ade`, `02bbd47a`) landed on `dev` as
direct owner pushes with no associated pull request, so no second maintainer
reviewed them. Requirement 3 is met by this file and `.github/CODEOWNERS`.
The addition is in effect regardless: @Wibias holds write access on the
repository and has been merging pull requests since 2026-07-26. This entry
records the gap rather than papering over it — a later maintainer change
should go through a reviewed pull request.
The addition took effect regardless: @Wibias held write access on the
repository and merged pull requests from 2026-07-26 until he stepped down on
2026-08-19. This entry records the gap rather than papering over it — a later
maintainer change should go through a reviewed pull request.

Scope covers issue and pull-request triage, `dev` integration, and
provider/CI maintenance. (This entry originally also described carrying
Expand Down
4 changes: 2 additions & 2 deletions src/adapters/kiro-tools.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ function ensureRootObjectType(schema: unknown): Record<string, unknown> {
// Seed with the root's own properties/required so a schema like
// { type:"object", properties:{path}, required:["path"], oneOf:[...] } keeps them.
if (obj.properties && typeof obj.properties === "object") {
Object.assign(props, sanitizeKiroSchema(obj.properties) as Record<string, unknown>);
Object.assign(props, sanitizeSchemaMap(obj.properties) as Record<string, unknown>);

@coderabbitai coderabbitai Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

bun - <<'BUN'
const source = JSON.parse('{"__proto__":{"type":"string"}}');
const out = {};

for (const [name, child] of Object.entries(source)) {
  out[name] = child;
}

if (Object.hasOwn(out, "__proto__")) {
  throw new Error("The reproduction did not expose the key-loss behavior");
}

console.log("Reproduced: __proto__ is not an own property.");
BUN

Repository: luvs01/opencodex

Length of output: 195

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- src/adapters/kiro-tools.ts ---'
sed -n '45,135p' src/adapters/kiro-tools.ts

printf '%s\n' '--- JavaScript special-key reproduction ---'
node - <<'JS'
const source = JSON.parse('{"__proto__":{"type":"string"}}');
const out = {};
for (const [name, child] of Object.entries(source)) out[name] = child;

console.log({
  sourceOwnProperty: Object.hasOwn(source, "__proto__"),
  outputOwnProperty: Object.hasOwn(out, "__proto__"),
  outputPrototype: Object.getPrototypeOf(out),
  outputPrototypeType: Object.getPrototypeOf(out)?.type,
});
JS

Repository: luvs01/opencodex

Length of output: 4853

Preserve __proto__ as a schema property name.

At src/adapters/kiro-tools.ts:106 and :121, Object.assign writes sanitized entries into normal props. sanitizeSchemaMap also writes entries into normal out at line 64. If the input contains properties.__proto__, the assignment invokes the prototype setter. The schema property is lost before Kiro receives the schema.

Use Object.create(null) for both out and props, or define entries with Object.defineProperty. Add a regression case for __proto__ beside format and pattern.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/adapters/kiro-tools.ts` at line 106, Preserve a literal __proto__ schema
property by using null-prototype objects for the output of sanitizeSchemaMap and
the props objects receiving its entries, or define assignments as own properties
with Object.defineProperty. Update both affected Object.assign paths and add a
regression case alongside format and pattern confirming __proto__ reaches Kiro
unchanged.

}
if (Array.isArray(obj.required)) {
for (const r of obj.required) if (typeof r === "string") required.add(r);
Expand All @@ -118,7 +118,7 @@ function ensureRootObjectType(schema: unknown): Record<string, unknown> {
if (!variant || typeof variant !== "object" || Array.isArray(variant)) continue;
const v = variant as Record<string, unknown>;
if (v.properties && typeof v.properties === "object") {
Object.assign(props, sanitizeKiroSchema(v.properties) as Record<string, unknown>);
Object.assign(props, sanitizeSchemaMap(v.properties) as Record<string, unknown>);
}
if (mergeRequired && Array.isArray(v.required)) {
for (const r of v.required) if (typeof r === "string") required.add(r);
Expand Down
10 changes: 10 additions & 0 deletions tests/kiro-adapter.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -674,6 +674,16 @@ describe("kiro adapter — buildRequest", () => {
const withDefs = await pick({ $defs: { X: { type: "string" } }, anyOf: [{ properties: { a: { $ref: "#/$defs/X" } } }] });
expect(withDefs.$defs).toEqual({ X: { type: "string" } });
expect(withDefs.properties).toEqual({ a: { $ref: "#/$defs/X" } });

// Property names remain data while flattening, even when they collide with rejected keywords.
const keywordNames = await pick({
properties: { format: { type: "string", format: "uuid" } },
required: ["format"],
oneOf: [{ properties: { pattern: { type: "string", pattern: "^x" } } }],
});
expect(keywordNames.properties.format).toEqual({ type: "string" });
expect(keywordNames.properties.pattern).toEqual({ type: "string" });
expect(keywordNames.required).toEqual(["format"]);
});

test("tool descriptions use deterministic model-specific caps without prompt injection", async () => {
Expand Down
Loading