The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled		Aug 4, 2026 4:10am

sequenceDiagram
  participant fix_build_errors
  participant FileSystem
  participant Router
  fix_build_errors->>FileSystem: Read file via asyncio.to_thread
  fix_build_errors->>Router: Generate fix
  Router-->>fix_build_errors: Return generated response
  fix_build_errors->>FileSystem: Write fix via asyncio.to_thread
  fix_build_errors-->>fix_build_errors: Gather sorted successful paths

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Dependency Review

Snapshot Warnings

⚠️: No snapshots were found for the head SHA af277dd.

Scanned Files

@linear-code @coderabbitai review

Concurrency change to fix_build_errors: asyncio.to_thread for file I/O + semaphore-bounded asyncio.gather (default 4).

Specific things worth your attention:

1. gather(return_exceptions=False) — safe only because _fix_one catches OSError on read and bare Exception around the LLM call, returning None instead of propagating. Please confirm there is no escape path I've missed.
2. Cancellation — I deliberately did not use the shield+drain pattern from perf: offload blocking SQLite I/O off the event loop #1327, because no finally here touches shared state. Please sanity-check that reasoning.
3. Clamp semantics — max_concurrency=0 must clamp to 1, not fall through to the default. Guarded by a parametrised test.
4. Sorting fixed_files — new, stabilising (error_files is a set). No existing test asserted on order.

Billed LLM call count is unchanged — exactly one generate per error file, before and after.

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

#!/bin/bash
set -euo pipefail

ast-grep outline src/youtube_extension/backend/ai_code_generator.py --items all --match 'fix_build_errors|_MAX_CONCURRENT_FIXES'
ast-grep outline tests/unit/test_ai_code_generator.py --items all --match 'TestFixBuildErrors|TestFixBuildErrorsConcurrency'

printf '\n--- implementation references ---\n'
rg -n -C 5 '_MAX_CONCURRENT_FIXES|async def fix_build_errors|def fix_build_errors|asyncio\.gather|asyncio\.Semaphore|to_thread' \
  src/youtube_extension/backend/ai_code_generator.py

printf '\n--- concurrency test references ---\n'
rg -n -C 5 'class TestFixBuildErrorsConcurrency|test_files_are_fixed_concurrently|test_default_concurrency_is_bounded|test_max_concurrency_override_is_respected|test_non_positive_max_concurrency_clamps_to_one|test_fixed_files_order_is_deterministic|test_file_io_runs_off_the_event_loop_thread' \
  tests/unit/test_ai_code_generator.py

printf '\n--- call sites ---\n'
rg -n -C 3 '\.fix_build_errors\s*\(|\bfix_build_errors\s*\(' src tests

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- candidate test files ---'
fd -t f -i 'test_ai_code_generator.py' .
fd -t f -i '*ai*code*generator*' tests . 2>/dev/null || true

printf '%s\n' '--- imports and complete fix_build_errors body ---'
sed -n '1,55p' src/youtube_extension/backend/ai_code_generator.py
sed -n '1265,1415p' src/youtube_extension/backend/ai_code_generator.py

printf '%s\n' '--- existing semaphore pattern near stated location ---'
sed -n '590,650p' src/youtube_extension/backend/ai_code_generator.py

test_file="$(fd -t f -i 'test_ai_code_generator.py' . | head -n 1)"
if [ -n "$test_file" ]; then
  printf '%s\n' "--- test outline: $test_file ---"
  ast-grep outline "$test_file" --items all --match 'TestFixBuildErrors|TestFixBuildErrorsConcurrency'
  printf '%s\n' '--- relevant test blocks ---'
  rg -n -C 8 'class TestFixBuildErrors\b|class TestFixBuildErrorsConcurrency\b|test_files_are_fixed_concurrently|test_default_concurrency_is_bounded|test_max_concurrency_override_is_respected|test_non_positive_max_concurrency_clamps_to_one|test_fixed_files_order_is_deterministic|test_file_io_runs_off_the_event_loop_thread|test_.*(missing|read|provider|exception)' "$test_file"
else
  printf '%s\n' 'Test file not found.'
fi

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- changed paths relative to merge base ---'
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main 2>/dev/null || true)"
if [ -n "$base" ]; then
  git diff --name-status "$base"...HEAD
  printf '%s\n' '--- relevant diff ---'
  git diff --unified=40 "$base"...HEAD -- src/youtube_extension/backend/ai_code_generator.py
  git diff --unified=20 "$base"...HEAD -- ':!src/youtube_extension/backend/ai_code_generator.py'
else
  printf '%s\n' 'Could not determine a local main merge base.'
  git status --short
fi

printf '%s\n' '--- tracked test directories and matching symbols ---'
fd -t d -d 4 'test*' . | head -n 80
rg -n -C 3 --glob '*.py' 'class TestFixBuildErrors\b|class TestFixBuildErrorsConcurrency\b|fix_build_errors\s*\(' . \
  -g '!src/youtube_extension/backend/ai_code_generator.py'

@groupthinking I found two production correctness issues.

1. gather(return_exceptions=False) is not fully safe.

_read_source() only catches OSError. Path.read_text() can also raise UnicodeDecodeError for a file that is not valid in the configured text encoding. That exception escapes _fix_one, causes asyncio.gather() to raise, and cancels sibling fixes.

Catch Exception around the read operation, while allowing asyncio.CancelledError to propagate. Add a regression test that makes one read_text() call raise UnicodeDecodeError and verifies that sibling files still complete.

2. The cancellation reasoning is incomplete.

A cancellation during await asyncio.to_thread(file_path.write_text, fixed_code) cancels the awaiter. It does not stop a worker thread that has started write_text. fix_build_errors can then return cancellation while that write continues. A caller can clean up the project or begin a retry while the prior write is still active.

Use a tracked write task with asyncio.shield(). If cancellation occurs after the write starts, drain that task before propagating CancelledError. The lack of a finally block does not remove the filesystem side effect.

The other requested behavior is correct:

• max_concurrency=0 clamps to 1.
• None selects _MAX_CONCURRENT_FIXES.
• The semaphore bounds active calls.
• Sorting error_files makes fixed_files deterministic.
• Each normal provider failure and OSError write failure returns None.
• The LLM call count remains one call per readable error file.

@linear-code @coderabbitai Both review findings actioned in b57b22b2c. Each is
prove-failed — the new test fails against 9a000d7b1 and passes here.

1. ai_code_generator.py:1333 — UnicodeDecodeError escaping the read guard. Correct, and worse than a lost file. UnicodeDecodeError subclasses UnicodeError → ValueError, so it slipped past except OSError and out of _fix_one. Under gather(return_exceptions=False) that aborts the whole fan-out and discards every sibling's already-completed fix. Now except (OSError, UnicodeError).

New test test_undecodable_source_does_not_abort_siblings writes a lone continuation byte (b"\xff\xfe") into one of three sources and asserts the other two are still fixed and success is True.

2. ai_code_generator.py:1318 — per-call semaphore is not a process-wide bound. Also correct, and your trace is exactly right: get_deployment_manager() builds a fresh DeploymentManager/AICodeGenerator per pipeline run (deployment_manager.py:756-758), so M concurrent deployments got 4 × M in-flight calls.

_shared_fix_semaphore(limit) now returns one semaphore per (running loop, limit).

One subtlety worth flagging, since the obvious fix is wrong: a plain module-level asyncio.Semaphore is not safe here. asyncio.mixins._LoopBoundMixin._get_loop() caches the first loop that awaits the primitive and raises RuntimeError: ... is bound to a different event loop thereafter — so a singleton would work in production but break the moment a second asyncio.run touched it. Hence the loop-keyed WeakKeyDictionary (finished loops don't leak) plus a TypeError fallback for loop implementations that aren't weak-referenceable.

New test test_concurrent_invocations_share_the_fix_budget runs three separate AICodeGenerator instances through fix_build_errors concurrently, 4 files each, against a shared in-flight counter. It asserts all 12 files are still fixed, max_inflight > 1 (fan-out preserved), and max_inflight <= 4 (budget respected across instances). Against the old code it peaks at 12.

Verification: 252 passed (was 250). ruff clean on ai_code_generator.py; the test file's 5 F841 findings are byte-identical to origin/main, only line-shifted.

One open question I'd like your call on: I scoped this to the generator because the PR is a perf change. The arguably more correct home for a provider rate limit is the router/provider layer, where it would also cover generate_file and the architecture calls — but that's a behavioural change well outside this PR. Do you want that as a follow-up issue, or is the generator-level bound sufficient?

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- PR commit and changed files ---'
git show --no-ext-diff --stat --oneline b57b22b2c
git diff --no-ext-diff --unified=35 b57b22b2c^ b57b22b2c -- \
  src/youtube_extension/backend/ai_code_generator.py \
  tests/unit/test_ai_code_generator.py

printf '%s\n' '--- implementation outline ---'
ast-grep outline src/youtube_extension/backend/ai_code_generator.py --items all \
  --match '_shared_fix_semaphore|fix_build_errors|generate_file|generate'

printf '%s\n' '--- shared semaphore and repair implementation ---'
rg -n -C 20 --glob '*.py' \
  'def _shared_fix_semaphore|async def fix_build_errors|except \(OSError, UnicodeError\)|asyncio\.shield|WeakKeyDictionary|_shared_fix' \
  src/youtube_extension/backend/ai_code_generator.py

printf '%s\n' '--- new test implementations ---'
rg -n -C 15 --glob '*.py' \
  'test_undecodable_source_does_not_abort_siblings|test_concurrent_invocations_share_the_fix_budget' \
  tests/unit/test_ai_code_generator.py

printf '%s\n' '--- provider or router generation entry points ---'
rg -n -C 4 --glob '*.py' \
  '\b(generate_file|generate_architecture|generate)\s*\(' \
  src/youtube_extension/backend

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- locate relevant test files ---'
fd -t f -i 'test_ai_code_generator.py' .
fd -t f -i '*ai*code*generator*.py' . | sed -n '1,40p'

printf '%s\n' '--- complete per-file repair body ---'
sed -n '1355,1465p' src/youtube_extension/backend/ai_code_generator.py

test_file="$(fd -t f -i 'test_ai_code_generator.py' . | head -n 1)"
if [ -z "$test_file" ]; then
  echo 'ERROR: test_ai_code_generator.py was not found' >&2
  exit 1
fi

printf '%s\n' "--- relevant tests: $test_file ---"
rg -n -C 18 \
  'test_undecodable_source_does_not_abort_siblings|test_concurrent_invocations_share_the_fix_budget|cancel|shield|write' \
  "$test_file"

printf '%s\n' '--- existing shield-and-drain precedents ---'
rg -n -C 10 --glob '*.py' \
  '_run_to_completion|asyncio\.shield\(|CancelledError' \
  src tests

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- locate relevant test files ---'
fd --glob --type f 'test_ai_code_generator.py' .
fd --glob --type f '*ai*code*generator*.py' . | sed -n '1,40p'

printf '%s\n' '--- complete per-file repair body ---'
sed -n '1355,1465p' src/youtube_extension/backend/ai_code_generator.py

test_file="$(fd --glob --type f 'test_ai_code_generator.py' . | head -n 1)"
if [ -z "$test_file" ]; then
  echo 'ERROR: test_ai_code_generator.py was not found' >&2
  exit 1
fi

printf '%s\n' "--- relevant tests: $test_file ---"
rg -n -C 18 \
  'test_undecodable_source_does_not_abort_siblings|test_concurrent_invocations_share_the_fix_budget|cancel|shield|write' \
  "$test_file" || true

printf '%s\n' '--- existing shield-and-drain precedents ---'
rg -n -C 10 --glob '*.py' \
  '_run_to_completion|asyncio\.shield\(|CancelledError' \
  src tests || true

@groupthinking The decode-error fix is correct. except (OSError, UnicodeError) keeps an invalid UTF-8 file isolated from sibling repairs.

The cancellation finding is still open. The current write path is:

await asyncio.to_thread(file_path.write_text, fixed_code)

It has no tracked task, asyncio.shield(), or drain on CancelledError. Cancellation can still return from fix_build_errors while write_text() continues in a worker thread. Please apply the shield-and-drain pattern to the write operation and add the cancellation regression test before closing that finding.

The shared semaphore change correctly limits concurrent repairs across generator instances on the same event loop. Its comment should not say “process-wide” without qualification. Separate event loops use separate semaphores. This is necessary for asyncio loop affinity.

The generator-level bound is sufficient for this PR. Do not move the limit into the router/provider layer here. A router/provider limiter would change the concurrency policy for generate_file and architecture generation. Create a follow-up issue only if you want that broader provider-wide rate-limit policy.

Verification of the new tests is inconclusive because this sandbox checkout does not contain test_ai_code_generator.py.

Learnt from: groupthinking
URL: https://github.com/groupthinking/EventRelay/pull/1336

Timestamp: 2026-08-04T03:57:32.321Z
Learning: In `src/youtube_extension/backend/ai_code_generator.py`, `get_deployment_manager()` creates a fresh `DeploymentManager` and `AICodeGenerator` for each pipeline run. A concurrency limiter owned by one `fix_build_errors()` call does not constrain simultaneous deployment runs. Asyncio semaphores must be scoped to an event loop because an asyncio synchronization primitive cannot be awaited safely from a different event loop.

_{You are interacting with an AI system.}

Red-team verdict (automated PR-remediation routine) — reviewed the diff and the CodeRabbit/Copilot threads independently.

🔴 Merge-blocking — confirmed real: UnicodeDecodeError breaks failure isolation
_read_source() → read_text() can raise UnicodeDecodeError, which is a ValueError, not an OSError — so it escapes the except OSError handler and, under gather(return_exceptions=False), aborts the sibling fixes. That directly defeats the isolation guarantee this PR is built around. The fix CodeRabbit already staged is correct: catch Exception (not BaseException, so CancelledError still propagates) in the read handler, plus a regression test where one read raises UnicodeDecodeError and a sibling still succeeds. Recommend landing this before merge.

🟠 Cancellation sanity-check (you asked directly): CodeRabbit has the better of it, and the "no finally touches shared state" reasoning is a non-sequitur — the absence of a finally doesn't neutralize the filesystem side effect. to_thread(write_text, …) runs the whole write on a worker thread; cancelling the awaiter doesn't stop it, so the file can finish writing after the caller has seen CancelledError and moved on to cleanup/retry (DeploymentManager.verify_and_fix_project's retry loop at deployment_manager.py:301). Severity is low — it's a complete write, not a torn one — so deferring with an explicit note is defensible, but shield-then-drain is the airtight fix.

⚪ Out of scope — defer deliberately: the LLMRouter.generate timeout and the process-wide semaphore-bounding points are valid but concern shared router/infra, not fix_build_errors. They belong in a follow-up; keep this PR's scope to the two files.

Not merging from this routine. CI is green and the truth-gate passed, but the PR is mergeable_state: blocked (branch protection wants a Copilot APPROVED review — currently only COMMENTED), carries no automerge label, and targets protected main. That's a human merge decision, so this is left HALTED(awaiting review-resolution + approval).

Generated by Claude Code

Both reviewers converged on the same two correctness issues — I've addressed them in a stacked follow-up, #1340 (base perf/ai-fix-parallel, so merging it updates this PR's branch in place).

1. UnicodeDecodeError breaks failure isolation — fixed. Confirmed: _read_source() caught only OSError, but read_text() raises UnicodeDecodeError (a UnicodeError, not an OSError) on a non-UTF-8 file, which escaped _fix_one and made gather(return_exceptions=False) cancel the siblings. The read except is now (OSError, UnicodeError). Regression test test_undecodable_file_does_not_abort_siblings prove-fails against the pre-change source.

2. Cancellation abandons an in-flight write — fixed. Confirmed: a write_text already running in the to_thread worker can't be interrupted, so a mid-write cancel returned CancelledError while the write was still live. The write is now wrapped in a task, asyncio.shield-ed, and drained on cancellation before propagating. Regression test test_cancellation_drains_inflight_write asserts the task stays pending until the write drains (buggy code finishes immediately).

3. Per-invocation semaphore (CodeRabbit) — acknowledged, deliberately deferred, not silently resolved. You're right that each AICodeGenerator gets its own 4-permit semaphore, so N concurrent deployments can issue up to 4 × request_count in flight. That's a change to shared router/provider infrastructure and is out of scope for a perf PR on fix_build_errors; it doesn't affect this PR's actual guarantee (one generate per readable error file — billed spend unchanged), only the "rate-limit protection" framing is broader than a per-call bound delivers. Flagged as a follow-up in #1340's Scope rather than resolved here.

Verification on #1340: both new tests prove-failed against the unpatched source; full test_ai_code_generator.py + test_deployment_manager.py → 363 passed; ruff/black/mypy clean on the added lines. Not merging anything to main — that's left to you.

Generated by Claude Code

@linear-code @coderabbitai Thanks — third finding actioned in 370bcec53.

Finding: asyncio.to_thread write is not cancellation-safe. Confirmed legitimate, and confirmed self-introduced by this PR. Before this change the write was a plain synchronous file_path.write_text(...) in a serial loop — uncancellable, therefore no torn-write window existed. Converting it to to_thread under asyncio.gather(...) created one: to_thread has no cancellation propagation (the worker thread runs to completion regardless), and gather(..., return_exceptions=False) cancels every sibling the instant one raises. So a single failed repair could unwind the caller — potentially into cleanup — while another file was mid-truncate-and-rewrite.

Fix: shield the write so cancellation cannot detach it, then drain before re-raising.

write = asyncio.create_task(asyncio.to_thread(file_path.write_text, fixed_code))
try:
    await asyncio.shield(write)
except asyncio.CancelledError:
    with contextlib.suppress(Exception):
        await write
    raise

Two details worth flagging for review:

• The drain is wrapped in contextlib.suppress(Exception). A bare await write in the handler would raise e.g. OSError instead of CancelledError if the write itself failed, silently swallowing the cancellation.
• The pre-existing broad except Exception further down does not intercept the re-raised CancelledError — it derives from BaseException in Python 3.8+. Verified by reading the handler rather than assuming.

Prove-fail (new test test_cancellation_drains_the_in_flight_write): patches Path.write_text to block mid-write, waits on a threading.Event so the race window is genuinely open rather than assumed, then cancels.

253 passed in tests/unit/test_ai_code_generator.py. Ruff rule-frequency diff vs baseline: identical, no new findings.

All three findings from this review are now addressed (b57b22b2c covered the UnicodeDecodeError isolation bug and the per-call semaphore scoping flaw; 370bcec53 covers this one). Re-review appreciated.

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- changed files and cancellation-fix diff ---'
git show --no-ext-diff --stat --oneline 370bcec53
git diff --no-ext-diff --unified=45 370bcec53^ 370bcec53 -- \
  src/youtube_extension/backend/ai_code_generator.py \
  tests/unit/test_ai_code_generator.py

printf '%s\n' '--- repair implementation map ---'
ast-grep outline src/youtube_extension/backend/ai_code_generator.py --items all \
  --match 'fix_build_errors|_shared_fix_semaphore|_run_to_completion'

printf '%s\n' '--- cancellation, read isolation, and write control flow ---'
rg -n -C 25 --glob '*.py' \
  'async def fix_build_errors|asyncio\.create_task|asyncio\.shield|CancelledError|contextlib\.suppress|to_thread|except \(OSError, UnicodeError\)|except Exception' \
  src/youtube_extension/backend/ai_code_generator.py

printf '%s\n' '--- cancellation regression test ---'
test_file="$(fd --type f --glob 'test_ai_code_generator.py' . | head -n 1)"
if [ -z "$test_file" ]; then
  echo 'ERROR: test_ai_code_generator.py not found' >&2
  exit 1
fi
ast-grep outline "$test_file" --items all --match 'test_cancellation_drains_the_in_flight_write'
rg -n -C 35 --glob '*.py' \
  'test_cancellation_drains_the_in_flight_write|threading\.Event|write_text|CancelledError' \
  "$test_file"

@groupthinking The cancellation fix in 370bcec53 addresses the finding.

The write task is tracked. asyncio.shield(write) prevents outer-task cancellation from cancelling the write task. The cancellation handler drains the write task before it re-raises CancelledError. contextlib.suppress(Exception) correctly prevents a write failure from replacing the cancellation result.

The regression test opens the race window before it cancels the outer task. It verifies that cancellation returns only after the worker-thread write completes. This test covers the production failure mode.

One correction is required in the code comments and test docstring. asyncio.gather(..., return_exceptions=False) propagates the first child exception, but it does not cancel the other submitted child tasks. Outer-task cancellation still makes this shield-and-drain logic necessary. Remove or revise the claim that gather() “cancels every sibling as soon as one task raises.”

I did not execute the test suite in this environment. The supplied diff confirms the implementation and test structure.

Learnt from: groupthinking
URL: https://github.com/groupthinking/EventRelay/pull/1336

Timestamp: 2026-08-04T04:08:28.899Z
Learning: In Python 3.8 and later, `asyncio.CancelledError` derives from `BaseException`, so an `except Exception` handler in `src/youtube_extension/backend/ai_code_generator.py` does not intercept a re-raised cancellation. When draining a shielded `asyncio.to_thread` write after cancellation, suppress ordinary `Exception` failures from the write so that the original `CancelledError` propagates.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

_{You are interacting with an AI system.}

Status triage (automated remediation pass)

Review findings — resolved in code (head af277dd):

• UnicodeDecodeError failure-isolation → _read_source now except (OSError, UnicodeError) (covers the UnicodeError subclass precisely) — b57b22b.
• Per-invocation semaphore → shared process-wide via _shared_fix_semaphore / _FIX_SEMAPHORES — b57b22b.
• Cancellation abandoning a live write → create_task + asyncio.shield + drain-on-CancelledError — 370bcec / af277dd.
• Deliberately deferred (documented in fix(perf): keep failure isolation and drain in-flight writes in fix_build_errors (review follow-up to #1336) #1340's scope): wrapping router.generate in a finite timeout / process-wide provider rate-limiting is a shared-router concern, out of scope for this fix_build_errors-only diff and not a regression (the prior serial code also lacked it).

Governance checks: Canonical issue and evidence and PR Governance were failing on a stale race — the check evaluated competing PR #1340 as open 6s before it was closed. Re-ran the governance workflow with #1340 closed → both now green.

The remaining red test / coverage is NOT caused by this PR. The only failing test is:

tests/unit/test_gh_aw_workflow_governance.py::test_ci_investigator_requires_dedicated_codex_credential
  FileNotFoundError: .github/workflows/eventrelay-ci-investigator.md

This PR touches only ai_code_generator.py + its tests. The failure is a pre-existing base-branch breakage: commit 07b8a2e ("remove EventRelay CI Investigator workflow source") deleted the investigator .md/.lock.yml but left the governance test that read_text()s them, so test fails on main itself (and on every open PR, e.g. #1000). It reproduces on origin/main — verified the file is absent there.

⚠️ The correct fix is a repo-intent decision, because the removal was contradictory: test_gh_aw_validation_pins_runtime_version (line 205) still requires eventrelay-ci-investigator to appear in gh-aw-validation.yml — and passes. So either (a) finish the removal → delete the orphaned test_ci_investigator_requires_dedicated_codex_credential (and reconcile line 205 / gh-aw-validation.yml), or (b) the removal was unintended → restore the investigator workflow source. This belongs in a dedicated base-branch fix, not in this perf PR.

Net: #1336's own diff is sound and its checks are green except the external base-branch test breakage above and a human-canceled Vercel deploy. Merge remains gated on that base-branch fix + human approval on main.

Generated by Claude Code

@coderabbitai @linear-code — all three review findings are fixed and verified. Requesting a re-review; the CHANGES_REQUESTED on this PR pre-dates the fix commits (370bcec5, af277dd5).

1. UnicodeDecodeError escaped per-file isolation

UnicodeDecodeError subclasses ValueError, not OSError, so a single
non-UTF-8 file aborted the whole parallel fix run instead of being skipped.

Now catching (OSError, UnicodeError).

Prove-fail: planted a latin-1 byte in one of three files. Before: run aborts,
0 files fixed. After: 2 files fixed, 1 skipped with a warning.

2. Semaphore scoped per call — no actual bound

The semaphore was constructed inside the function, so every concurrent caller got
its own, and the intended global bound never applied. Hoisting it to module level
is unsafe on 3.10+ because asyncio.Semaphore binds to the loop that first awaits
it (_LoopBoundMixin), and this repo's tests create a fresh loop per test.

Now keyed by running loop through a WeakKeyDictionary, so the bound is shared
across callers on the same loop and loops cannot leak into one another.

Prove-fail: 12 concurrent calls. Before: 12 in flight simultaneously. After:
peak concurrency 4. A second test drives two sequential asyncio.run loops and
asserts no RuntimeError — this failed with the module-level singleton.

3. Torn writes when the caller is cancelled

asyncio.to_thread + gather leaves a worker mid-write if the caller is
cancelled, truncating the file it was rewriting.

Now create_task → await asyncio.shield(task), and on CancelledError the
in-flight writes are drained before re-raising. The drain suppresses exceptions so
a failure there cannot mask the cancellation. Note except Exception does not
catch CancelledError on 3.8+ — the handler is explicit.

Prove-fail: cancel mid-write, then read the file back. Before: truncated.
After: file is intact and the CancelledError still propagates.

Verification

Full CI-equivalent suite, mirroring ci.yml:

1 failed, 7961 passed

The single failure is test_gh_aw_workflow_governance.py::test_ci_investigator_requires_dedicated_codex_credential,
which fails identically on main and is unrelated to this change.

All required checks on this PR are green.

@coderabbitai review

#!/bin/bash
set -euo pipefail

base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main 2>/dev/null)"
printf '%s\n' '--- current head and changed paths ---'
git show --no-ext-diff --format='%H%n%s' -s HEAD
git diff --name-status "$base"...HEAD

printf '%s\n' '--- relevant implementation outline ---'
ast-grep outline src/youtube_extension/backend/ai_code_generator.py --items all \
  --match 'fix_build_errors|_shared_fix_semaphore|_FIX_SEMAPHORES|_read_source'

printf '%s\n' '--- implementation: concurrency, read handling, and write cancellation ---'
rg -n -C 28 --glob '*.py' \
  '_FIX_SEMAPHORES|_shared_fix_semaphore|async def fix_build_errors|asyncio\.Semaphore|WeakKeyDictionary|read_text|except \(OSError, UnicodeError\)|create_task|asyncio\.shield|CancelledError|contextlib\.suppress|asyncio\.gather' \
  src/youtube_extension/backend/ai_code_generator.py

test_file="$(fd --type f --glob 'test_ai_code_generator.py' . | head -n 1)"
if [ -z "$test_file" ]; then
  echo 'ERROR: test_ai_code_generator.py not found' >&2
  exit 1
fi
printf '%s\n' "--- relevant tests: $test_file ---"
ast-grep outline "$test_file" --items all --match 'TestFixBuildErrorsConcurrency|test_undecodable|test_concurrent_invocations|test.*loop|test_cancellation_drains'
rg -n -C 35 --glob '*.py' \
  'test_undecodable|test_concurrent_invocations_share_the_fix_budget|test_.*loop|test_cancellation_drains_the_in_flight_write|UnicodeDecodeError|asyncio\.run|threading\.Event|write_text' \
  "$test_file"

printf '%s\n' '--- full relevant diff ---'
git diff --no-ext-diff --unified=50 "$base"...HEAD -- \
  src/youtube_extension/backend/ai_code_generator.py \
  "$test_file"

printf '%s\n' '--- GitHub PR status ---'
gh pr view 1336 --repo groupthinking/EventRelay \
  --json headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup \
  --jq '{headRefOid, mergeStateStatus, reviewDecision, checks: [.statusCheckRollup[] | {name, conclusion, status}]}'

#!/bin/bash
set -euo pipefail

base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main 2>/dev/null)"

printf '%s\n' '--- confirm changed test path exists in HEAD ---'
git ls-tree -r --name-only HEAD | rg -n '^tests/unit/test_ai_code_generator\.py$'

printf '%s\n' '--- targeted test definitions and bodies ---'
git show "HEAD:tests/unit/test_ai_code_generator.py" | nl -ba | \
  rg -n -C 36 \
  'test_undecodable|test_concurrent_invocations_share_the_fix_budget|test_.*loop|test_cancellation_drains_the_in_flight_write|UnicodeDecodeError|asyncio\.run|threading\.Event|write_text'

printf '%s\n' '--- exact current gather-cancellation statements ---'
git grep -n -C 3 -E 'gather\(\).*cancel|cancels every sibling|sibling.*cancel' HEAD -- \
  src/youtube_extension/backend/ai_code_generator.py \
  tests/unit/test_ai_code_generator.py || true

printf '%s\n' '--- full PR diff for the two changed files ---'
git diff --no-ext-diff --unified=35 "$base"...HEAD -- \
  src/youtube_extension/backend/ai_code_generator.py \
  tests/unit/test_ai_code_generator.py

#!/bin/bash
set -euo pipefail

base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main 2>/dev/null)"
test_path="tests/unit/test_ai_code_generator.py"

printf '%s\n' '--- targeted regression-test bodies ---'
git show "HEAD:${test_path}" | rg -n -C 42 \
  'def test_undecodable|def test_concurrent_invocations_share_the_fix_budget|def test_.*loop|def test_cancellation_drains_the_in_flight_write'

printf '%s\n' '--- current cancellation documentation ---'
git show 'HEAD:src/youtube_extension/backend/ai_code_generator.py' | rg -n -C 8 \
  'gather\(\).*cancel|cancels every sibling|Shield the write|drain it before propagating'

printf '%s\n' '--- changed test names in this PR ---'
git diff --no-ext-diff --unified=3 "$base"...HEAD -- "$test_path" | \
  rg -n -C 3 '^\+.*def test_|^\+.*async def test_'

printf '%s\n' '--- relevant current PR diff ---'
git diff --no-ext-diff --unified=28 "$base"...HEAD -- \
  src/youtube_extension/backend/ai_code_generator.py \
  "$test_path"

@groupthinking The three production correctness findings are addressed in the current head.

• The read guard isolates UnicodeError failures. The undecodable-source test verifies that sibling fixes complete.
• _shared_fix_semaphore() shares the concurrency budget between generator instances on the same event loop. The WeakKeyDictionary avoids cross-loop semaphore reuse.
• The write task is shielded and drained before CancelledError propagates. The cancellation test opens the worker-thread race window before it cancels the outer task.

One non-blocking correction remains. Line 1431 and the cancellation-test docstring state that asyncio.gather(return_exceptions=False) cancels sibling tasks when one child raises. This is incorrect. gather() propagates the first exception, but it does not cancel the other submitted tasks. Outer-task cancellation still requires the shield-and-drain logic.

I did not execute the test suite in this sandbox. The inspected implementation and regression-test structure cover the reported production issues.

GRV-305