fix: guard ungrounded research when discovery finds no URLs; refresh deploy docs - #4
Conversation
…kflow docs - Bump all actions to exact latest stable versions across 9 workflows: checkout@v7.0.1, codeql-action@v4.37.6, github-script@v9.0.0, osv-scanner-action@v2.5.0, release-please-action@v5.0.0, setup-python@v7.0.0, lychee-action@v2.9.0, scorecard-action@v2.4.4, action-semantic-pull-request@v6.1.1, stale@v11.0.0 - Fix repo-lint stale-reference check self-match and KhazP/Reddit-to-AI false positive - Fix labels.yml stale 'Vibe-coding' workflow label description - Add tool adapters for opencode, gemini-cli, copilot, windsurf, lovable - Add .claude skills, templates/, examples/, scripts/validate.py, CITATION.cff - Update AGENTS/MEMORY/agent_docs for Gemini 3.x model routing correction - Ignore session-ses_0*.md
- Click-by-click setup for GitHub settings, Gemini key, Cloudflare Worker secret (GEMINI_API_KEY), ALLOWED_ORIGIN var, Pages deploy, and code placeholders, so the first push runs green - Fix broken github.com/zarishsphere links in docs (org is zsdotcom) - Ignore wrangler's .dev.vars local secret file
…d deployment details
…deploy docs - researchIdea retries Flash-Lite discovery once, then throws a retryable AppError instead of running url_context grounding with zero candidate URLs (which let the model answer from memory and fabricate 'verified' citations) - drop unused requirement param from discoverySystemFor - correct pages deploy command (repo root, not src/) in AGENTS.md/SETUP.md/TechDesign - replace stale not-deployed/placeholder claims with live endpoints in AGENTS/README/SETUP/REPOSITORY-INVENTORY/copilot-instructions/tech_stack - real ALLOWED_ORIGIN in worker test fixture and wrangler.toml comment - add 2 research tests (suite now 55); update MEMORY.md state
|
Important Review skippedToo many files! This PR contains 111 files, which is 11 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (111)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eee6e4848a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const response = await callLLM( | ||
| buildResearchPayload(requirement, candidateUrls), | ||
| options, | ||
| ); |
There was a problem hiding this comment.
When discovery returns syntactically valid but unfetchable URLs, the new url_context call can come back without groundingMetadata.groundingChunks; this path still accepts the response and parseResearchResponse can merge the model's self-reported citation URLs, so a 404/blocked candidate source is emitted as verified research instead of failing or retrying. Check for at least one citation from citationsFromResponse(response) before accepting the finding so the no-ungrounded-research guard also covers failed URL Context fetches.
Useful? React with 👍 / 👎.
| permissions: | ||
| security-events: write # to upload SARIF results | ||
| id-token: write # to sign artifacts with fulcio |
There was a problem hiding this comment.
In this Scorecard workflow, the job-level permissions block overrides the top-level read-all; GitHub's workflow syntax says unspecified permissions are set to none when any are listed (https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions#permissions). In private/internal repos or orgs that require token-authenticated checkout, the following actions/checkout step will not have contents: read and the Scorecard job can fail before producing SARIF, so include contents: read alongside these write scopes.
Useful? React with 👍 / 👎.
| "hooks": [ | ||
| { | ||
| "type": "command", | ||
| "command": "node -e \"const fs=require('fs'); const d=JSON.parse(fs.readFileSync(0,'utf8')); const p=d.tool_input?.file_path||''; if(/\\.(ts|tsx|js|jsx)$/.test(p) && fs.existsSync('node_modules/.bin/prettier')) { require('child_process').execSync('npx prettier --write \\\"'+p+'\\\"', {stdio:'inherit'}); }\"", |
There was a problem hiding this comment.
When a prompt or skill causes Claude to Write/Edit a JS/TS file whose path contains a quote and shell metacharacters, this hook interpolates file_path into a string passed to execSync, so the path can break out of the quoted npx prettier argument and run arbitrary commands on the developer machine. Invoke Prettier with an argument-vector API such as execFileSync/spawnSync, or safely escape the path before using a shell.
Useful? React with 👍 / 👎.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
codeandbrain
left a comment
codeandbrain
left a comment
There was a problem hiding this comment.
LGTM — all required checks pass (CodeQL, OSV-Scanner, Repo Lint, CodeRabbit). Discovery retry/guard and deploy-doc refresh look correct.
GitHub names checks after the job key, so 'Repo Lint' produced 'validate' and 'Semantic PR title' never ran (pull_request_target + job 'main'). Rename the jobs so the required checks exist. Switch semantic-pr to pull_request so it runs on PR branches, not the base.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
3 participants
Review-fix pass for the unmerged main changes (Gemini 3.x re-routing + two-step discovery→url_context pipeline + setup docs).
Bug fix
researchIdearetries Flash-Lite URL discovery once when it returns zero candidates, then throws a retryableAppError— instead of runningurl_contextgrounding with nothing to fetch, which let the model answer from memory and pass self-authored citations off as verified sources (src/agents/research.js).requirementparam fromdiscoverySystemFor(src/agents/prompts.js).Deploy docs refreshed (were contradicted by the change set)
wrangler pages deploy srccommand (static files live at repo root) →wrangler pages deploy . --project-name zarishdocs --branch main --commit-dirty=trueinAGENTS.md/SETUP.md/TechDesign §13.zarishdocs-proxy.zarishsphere.workers.dev,zarishdocs.pages.dev) inAGENTS.md,README.md,SETUP.md,REPOSITORY-INVENTORY.md,.github/copilot-instructions.md,agent_docs/tech_stack.md,worker/wrangler.toml.MEMORY.mdcurrent-state/known-issues updated; worker test fixture now uses the real origin.Supersedes PR #3 (its commits
96bb095/65f391fare included in this branch).