Verify the skill against CLI v0.2.35 and correct the detection boundary - #15
Merged
Conversation
|
Warning Review limit reached
Next review available in: 48 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthroughThe PR updates CodeTruss CLI documentation from v0.2.30 to v0.2.35. It documents local JavaScript and TypeScript SAST coverage, hosted-only boundaries, receipt reporting, non-blocking findings, and safe suggested-fix handling. Validation checks now enforce the revised guidance. ChangesCodeTruss documentation updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The skill and READMEs said a local run never performs injection or taint analysis. As of CLI v0.2.35 that is false: the shared SAST engine and its source-to-sink taint tracking run locally over JavaScript, TypeScript and TSX, covering SQL injection, mass assignment, un-awaited database writes, swallowed errors, coercion-prone `==`, and N+1 queries in loops. Leaving the old sentence in place would have the agent tell developers their code was never checked for a class the CLI now checks. What is still hosted is now stated precisely instead of categorically: the rest of the rule pack, every non-JavaScript language, and the symbol graph. The skill directs the agent to read the receipt's own "What did not run" section rather than assert either boundary from memory, since it moves. Also new, and both verified against the 0.2.35 tarball rather than the changelog: - v0.2.32 infers the scope of a turn when no allow policy exists and marks those files `allowed (inferred)`. A clean first run now exits 0 where it used to exit 1, so the skill says to treat an inferred allow as weaker evidence than a declared boundary. - v0.2.34 attaches a Suggested fixes section to some findings. The skill says to present and never auto-apply one, and to keep rotation first for a credential, whose diff is masked and cannot apply cleanly by design. Local security findings are REVIEW_REQUIRED at most and never fail a verdict on their own; the skill now says so, so an agent does not escalate one as blocking. The CLI floor and the "verified against" line move to v0.2.35 across the canonical skill and all three READMEs. Every documented command was rechecked against `--help` from the real 0.2.35 binary and still holds, including `verify-policy trust-key`, which 0.2.35 now lists in its own banner. The README's verbatim receipt excerpt is a real 0.2.35 run reproducing the same scenario, not the 0.2.30 capture edited by hand — same policy digest d13f4367…, new session, new profile `local-registry-v2`. validate.mjs pins the replacement claims so the next version bump cannot quietly restore the old wording: the v0.2.35 floor, `stay hosted-only`, the instruction to read "What did not run", and the REVIEW_REQUIRED ceiling. No version bump and no tag: v0.1.7 is the founder's call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
DeliriumPulse
force-pushed
the
chore/cli-0.2.35
branch
from
August 7, 2026 05:30
2d5971c to
471c270
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/codetruss-claude/README.md`:
- Around line 22-24: Update scripts/validate.mjs in its README validation logic
to deterministically assert the corrected security-boundary wording in
plugins/codetruss-claude/README.md: require the v0.2.35 local JavaScript,
TypeScript, and TSX security-pass wording and the hosted “What did not run” gap,
while rejecting stale or incomplete text. Keep the existing version and
installation checks intact.
In `@README.md`:
- Around line 90-102: The local security receipt under “What the local security
pass checked” is incomplete. Update the README receipt to match the exact
v0.2.35 wording and include un-awaited database writes, swallowed errors,
coercion-prone ==, and N+1 queries alongside SQL injection and mass assignment,
while preserving the excluded-rule scope documented elsewhere.
In `@scripts/validate.mjs`:
- Around line 22-32: Update the validation assertions around the existing
canonical skill-line checks in scripts/validate.mjs to also require the README
and skill text covering JavaScript, TypeScript, and TSX coverage, the complete
local rule list, and excluded hosted categories. Use exact string assertions
matching the documented boundary wording so removal or alteration of those lines
causes validation to fail.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0838dc0d-7999-44b1-bf56-45b88caf9823
📒 Files selected for processing (7)
README.mdplugins/codetruss-claude/README.mdplugins/codetruss-claude/skills/codetruss/SKILL.mdplugins/codetruss/README.mdplugins/codetruss/skills/codetruss/SKILL.mdscripts/validate.mjsskills/codetruss/SKILL.md
… pass The README calls this block a verbatim excerpt, and the two security sections were trimmed. That trim cut in the wrong direction twice: the local pass looked like it checks two rule classes when it checks six, and the gap list looked like two items when it is five. Understating what runs is the same category of error as overstating it, and this repository exists to keep the skill from doing either. Both sections are now quoted whole, and verified equal to the real 0.2.35 receipt after normalizing line wrapping rather than by eye. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed and why
The skill told agents that "a local run never performs injection or taint analysis." CLI v0.2.35 made that false. The shared SAST engine and its source-to-sink taint tracking now run locally over JavaScript, TypeScript and TSX.
Left alone, the plugin would have agents tell developers their code was never checked for a class the CLI had just started checking — the exact failure mode the pinned trust-boundary strings in
validate.mjsexist to prevent.Verified against the real 0.2.35 tarball, not the changelog
Extracted
codetruss-cli-0.2.35.tgzand ran the binary:--helpon the built binaryverify-policy trust-key--help--help" note is stale)reviewrunlocal-registry-v2, "What the local security pass checked" section presentreviewwith no--allowallowed (inferred), clean run exits 0reviewover a committed Stripe key--help+ real runsBecause every documented command still holds, this is a version-reference and truth update rather than a rewrite.
Changes
REVIEW_REQUIREDceiling for local security findings, so an agent does not escalate one as blocking.validate.mjsrequires).d13f4367…, new session, new profile.validate.mjspins the replacement claims — the v0.2.35 floor,stay hosted-only, the "What did not run" instruction, and theREVIEW_REQUIREDceiling — so a future bump cannot quietly restore the old wording.Validation
npm test—CodeTruss Claude, Codex, and Agent Skills packages validated.npm run release:verify—CodeTruss plugin release archives are byte-for-byte reproducible.Both re-run against the committed tree, not just the working copy.
Not done deliberately
No version bump and no tag. v0.1.7 is the founder's call, so
package.json,package-lock.json, and all three manifests stay at 0.1.6 andvalidate.mjsstill enforces that they agree.Summary by CodeRabbit
Documentation
REVIEW_REQUIREDlocal findings.Validation