Conversation
Signed-off-by: Dante <duanjl.china@gmail.com>
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 5 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 1 PR taxonomy bucket(s): CI/CD Recommendation. Scanned 5 changed file(s). Roadmap taxonomy buckets: CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 5 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 5 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (37)
🧰 Additional context used📓 Path-based instructions (18)Lightweight agents with frequent invocation Pair programming and code generation Worker agents in multi-agent systems Main development work Orchestrating multi-agent workflows Complex coding tasks Complex architectural decisions Maximum rea...📄 CodeRabbit inference engine (.cursor/rules/common-performance.md) Files:
NEVER hardcode secrets in source code - ALWAYS use environment variables or a secret manager📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
No hardcoded secrets (API keys, passwords, tokens) - validate before any commit📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Always create new objects, never mutate existing ones.📄 CodeRabbit inference engine (.cursor/rules/common-coding-style.md) Files:
Use parameterized queries to prevent SQL injection📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Implement XSS prevention by sanitizing HTML output📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
All user inputs must be validated Enable CSRF protection on all state-changing endpoints Verify authentication and authorization for all protected endpoints Implement rate limiting on all endpoints to prevent abuse Ensure error messages do...📄 CodeRabbit inference engine (.cursor/rules/common-security.md) Files:
Write tests before implementation (test-driven development); target 80%+ coverage Achieve minimum 80% test coverage across all three layers: Unit, Integration, and E2E Use AAA structure (Arrange / Act / Assert) in tests with descriptive tes...📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Do not hardcode secrets, API keys, passwords, or tokens📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Always create new objects and never mutate in place; return new copies instead Keep files between 200–400 lines typical, with a maximum of 800 lines Extract helpers when a file exceeds 200 lines Handle errors explicitly at every level; neve...📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
HTML output must be sanitized where applicable📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Auto-format JavaScript/TypeScript files using Prettier after edit Warn about `console.log` statements in edited files Check all modified files for `console.log` statements before session ends📄 CodeRabbit inference engine (.cursor/rules/typescript-hooks.md) Files:
Never hardcode secrets; always use environment variables for sensitive credentials like API keys Throw an error when required environment variables are not configured to fail fast and ensure security prerequisites are met📄 CodeRabbit inference engine (.cursor/rules/typescript-security.md) Files:
Use Playwright as the E2E testing framework for critical user flows in TypeScript/JavaScript📄 CodeRabbit inference engine (.cursor/rules/typescript-testing.md) Files:
Use spread operator for immutable updates in TypeScript/JavaScript instead of direct mutation Use async/await with try-catch for error handling in TypeScript/JavaScript Use Zod for schema-based input validation in TypeScript/JavaScript No c...📄 CodeRabbit inference engine (.cursor/rules/typescript-coding-style.md) Files:
Use the ApiResponse interface pattern with generic type parameter: `interface ApiResponse { success: boolean; data?: T; error?: string; meta?: { total: number; page: number; limit: number; } }` Implement custom React hooks following the...📄 CodeRabbit inference engine (.cursor/rules/typescript-patterns.md) Files:
Required environment variables must be validated at startup📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
Use parameterized queries for all database writes (no string interpolation) Auth/authz must be checked server-side for every sensitive path Rate limiting must be applied to all public endpoints📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe OpenCode home target now installs compiled plugin and tool JavaScript files. The install flow validates and removes obsolete managed TypeScript runtime sources. Tests cover planning, validation, integrity checks, replacement, cleanup, and persisted install state. ChangesOpenCode runtime installation
Priority: ⬆️ High Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix · Severity of issue fixed: High Sequence Diagram(s)sequenceDiagram
participant InstallPlan
participant OpenCodeHomeTarget
participant InstallState
participant RuntimeMigration
InstallPlan->>OpenCodeHomeTarget: plan compiled plugin and tool files
OpenCodeHomeTarget-->>InstallPlan: return managed operations
InstallPlan->>RuntimeMigration: prepare legacy source migration
RuntimeMigration->>InstallState: read prior managed operations
RuntimeMigration-->>InstallPlan: return verified removals
InstallPlan->>InstallState: persist compiled operations
Merge Risk: 🔵 Low · up to If installation fails after compiled files are written, old and new OpenCode layouts can coexist and later retry or uninstall may leave orphaned runtime files. Repair remains available, so this is a bounded follow-up risk. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Signed-off-by: Dante <duanjl.china@gmail.com>
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 6 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 1 PR taxonomy bucket(s): CI/CD Recommendation. Scanned 6 changed file(s). Roadmap taxonomy buckets: CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 6 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 6 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
Signed-off-by: Dante <duanjl.china@gmail.com>
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 6 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 1 PR taxonomy bucket(s): CI/CD Recommendation. Scanned 6 changed file(s). Roadmap taxonomy buckets: CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 6 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 6 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
1 participant
What Changed
plugins/andtools/paths while retaining the completedist/payloadWhy This Change
OpenCode loads
./pluginsfrom the installed configuration, but the home installer copied the TypeScript source tree there. Those sources use NodeNext-style.jsspecifiers whose adjacent JavaScript exists only in the compiled output, causingERR_MODULE_NOT_FOUND. Installing the compiled runtime at OpenCode's active paths preserves the intended import contract.Fixes #3112
Testing Done
node tests/lib/install-targets.test.js— 53 passed, 0 failednode tests/lib/install-executor.test.js— 21 passed, 0 failednode scripts/build-opencode.js— passedgit diff --check— passedType of Change
fix:Bug fixSecurity & Quality Checklist