Skip to content

Honor force-included paths in lazy repo metadata#12235

Merged
moirahuang merged 1 commit into
masterfrom
moira/lazy-force-included-paths
Jun 5, 2026
Merged

Honor force-included paths in lazy repo metadata#12235
moirahuang merged 1 commit into
masterfrom
moira/lazy-force-included-paths

Conversation

@moirahuang
Copy link
Copy Markdown
Contributor

@moirahuang moirahuang commented Jun 4, 2026

Description

  • Make force-included paths override the shallow tree depth limit.
  • Preserve lazy loading for unrelated branches while discovering initial project skills.
  • Verify existing watcher updates emit standing-query skill deltas.

Linked Issue

  • The linked issue is labeled ready-to-spec or ready-to-implement.
  • Where appropriate, screenshots or a short video of the implementation are included below.

Testing

  • ./script/format

  • ./script/format --check

  • cargo nextest run -p repo_metadata --features local_fs (100 passed, 2 skipped)

  • cargo clippy -p repo_metadata --all-targets --tests --features local_fs -- -D warnings

  • cargo clippy --workspace --exclude warp_completer --all-targets --tests -- -D warnings

  • cargo clippy -p warp_completer --all-targets --tests -- -D warnings

  • I have manually tested my changes locally with ./script/run

Agent Mode

Screenshot 2026-06-04 at 5 34 43 PM
  • Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-BUG-FIX: Discover project skills under force-included paths when repo metadata is lazily loaded.

Co-Authored-By: Oz oz-agent@warp.dev

Co-Authored-By: Oz <oz-agent@warp.dev>
@cla-bot cla-bot Bot added the cla-signed label Jun 4, 2026
@oz-for-oss
Copy link
Copy Markdown
Contributor

oz-for-oss Bot commented Jun 4, 2026

@moirahuang

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

Copy link
Copy Markdown
Contributor

@oz-for-oss oz-for-oss Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overview

This PR updates lazy repository metadata so configured force-included paths, such as project skill provider directories, continue to be traversed past the shallow tree depth and adds focused tests for initial discovery plus watcher deltas.

Concerns

  • Force-included subtrees now bypass the only directory-depth guard, while the existing budget only counts files. A repo can create an arbitrarily deep .agents/skills directory chain with few or no files and force unbounded traversal plus recursive assembly during lazy indexing.

Security

  • The unbounded force-included traversal is a resource-exhaustion risk for untrusted repositories and should keep a hard directory/depth limit or directory budget even while overriding the shallow lazy depth.

Verdict

Found: 0 critical, 1 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz


// If we've reached the max depth, force lazy-loading even of non-ignored folders unless the
// folder is on the path to a force-included subtree.
let mut lazy = current_depth >= options.max_depth && !force_included;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ [IMPORTANT] [SECURITY] This makes force-included subtrees bypass the only directory-depth guard. The file budget does not count directories, so an untrusted repo can create a very deep .agents/skills directory chain with few/no files and force unbounded traversal plus recursive assemble_node calls during lazy indexing; keep a hard depth or directory budget for force-included descendants while still loading the intended provider path.

@moirahuang moirahuang requested a review from kevinyang372 June 5, 2026 00:35
Copy link
Copy Markdown
Contributor Author

moirahuang commented Jun 5, 2026

Merge activity

  • Jun 5, 1:03 AM UTC: A user started a stack merge that includes this pull request via Graphite.
  • Jun 5, 1:04 AM UTC: @moirahuang merged this pull request with Graphite.

@moirahuang moirahuang merged commit e8024b5 into master Jun 5, 2026
37 checks passed
@moirahuang moirahuang deleted the moira/lazy-force-included-paths branch June 5, 2026 01:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants