From a46fb916a008afef878e66a63a799c8efdda2da3 Mon Sep 17 00:00:00 2001 From: Evandro Fonseca Junior Date: Wed, 30 Sep 2026 17:10:30 -0300 Subject: [PATCH] fix: resolve diagnostic paths and recover time injection --- CHANGELOG.md | 4 ++++ README.md | 8 +++++++- lib/config.ts | 2 +- lib/paths.ts | 7 +++---- lib/time-injection.ts | 1 + package-lock.json | 6 +++--- package.json | 6 +++--- tests/paths.test.ts | 12 ++++++++++++ tests/time-injection.test.ts | 14 ++++++++++++++ 9 files changed, 48 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ab46fd..9d94020 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ ## Unreleased +- `Time Injection`: Reject non-finite configured intervals and resume time annotations after the wall clock moves backwards. +- `Paths`: Resolve diagnostic paths from the current agent directory and profile instead of reporting hard-coded `~/.pi` locations. +- `Security`: Apply the `brace-expansion` `5.0.12` override at both root and coding-agent scopes to address the latest recursion and expansion denial-of-service advisories. + - **Security overrides refreshed** — `protobufjs` `7.6.4` → `7.6.6`, `undici` `8.5.0` → `8.10.2`, and a new `brace-expansion` `5.0.9` override keep `npm audit` at 0 vulnerabilities; the `validate` gate (`typecheck` → `test` → `audit` → `pack:check`) passes again. - **README rewritten** to the repository audit standard: verified install/build/test commands, the real `omp install` syntax, omp agent-directory resolution, and an explicit limitations section. - **Release notes extraction fixed** — the `0.22.0-evandro.1` fork section promoted from `###` to `##` so `.github/workflows/release.yml` can build release notes for tag `v0.22.0-evandro.1`. diff --git a/README.md b/README.md index e25dae6..50eafe4 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ > Fork of [`@llblab/pi-telegram@0.22.0`](https://github.com/llblab/pi-telegram/tree/v0.22.0) (SHA `afe09c5`), republished as `@evandrodevbr/oh-my-pi-telegram` for `omp`. > Lineage: `badlogic/pi-telegram` → `llblab/pi-telegram` (0.22.0) → **this fork**. -> The fork adds `omp` compatibility metadata in `package.json` and this README; the runtime code is upstream 0.22.0. +> The fork is based on upstream 0.22.0, with `omp` compatibility metadata and local runtime fixes recorded in `CHANGELOG.md`. ## About @@ -249,3 +249,9 @@ The test suite is deterministic and offline: transport calls are injected, so no ## License MIT. See [`LICENSE`](LICENSE), which keeps the copyright notices of the upstream chain (`badlogic/pi-telegram`, `llblab/pi-telegram`) alongside this fork's. + +## Review checks (2026-09-30) + +Diagnostics report the resolved agent directory, including `omp` and `PI_CODING_AGENT_DIR` overrides, with isolated profile suffixes. Interval time injection recovers after a backward wall-clock adjustment and rejects non-finite intervals. The `brace-expansion` security override is updated to 5.0.12. + +Focused offline checks: `node --experimental-strip-types --test tests/time-injection.test.ts tests/paths.test.ts tests/config.test.ts tests/status.test.ts`, followed by `npm run typecheck`. The Domain DAG check remains part of architecture validation. Run `npm run validate` in an environment that permits Unix-domain sockets; this review's restricted environment blocks the bus socket tests. No live bot, Telegram client or Windows IPC session was used. diff --git a/lib/config.ts b/lib/config.ts index 009e6fd..a8756fa 100644 --- a/lib/config.ts +++ b/lib/config.ts @@ -669,7 +669,7 @@ export function resolveTelegramTimeConfig( ? raw.injectionMode : "hidden"; const interval = - typeof raw?.interval === "number" && raw.interval > 0 + typeof raw?.interval === "number" && Number.isFinite(raw.interval) && raw.interval > 0 ? raw.interval : 60 * 60 * 1000; const timezone = getSystemTimezone(); diff --git a/lib/paths.ts b/lib/paths.ts index 8d5fd00..1186d0f 100644 --- a/lib/paths.ts +++ b/lib/paths.ts @@ -75,11 +75,10 @@ export function getTelegramDiagnosticsDisplayPaths(profileName?: string): { state: string; logs: string; } { - const suffix = getTelegramProfilePathSuffix(profileName); - const profileSlug = suffix.slice(1); + const agentDir = resolveAgentDir(); return { - state: `~/.pi/agent/tmp/telegram/state${suffix}.json`, - logs: `~/.pi/agent/tmp/telegram/logs${profileSlug ? `.${profileSlug}` : ""}.jsonl`, + state: resolveTelegramProfileTempFilePath("state", "json", agentDir, profileName), + logs: resolveTelegramProfileTempFilePath("logs", "jsonl", agentDir, profileName), }; } diff --git a/lib/time-injection.ts b/lib/time-injection.ts index dff2df3..333e417 100644 --- a/lib/time-injection.ts +++ b/lib/time-injection.ts @@ -67,6 +67,7 @@ export function createTimeInjectionRuntime( const nowMs = now.getTime(); if ( previous !== undefined && + nowMs >= previous && nowMs - previous < config.interval ) { return null; diff --git a/package-lock.json b/package-lock.json index 65f40e6..ef1d594 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1362,9 +1362,9 @@ "peer": true }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "license": "MIT", "peer": true, "dependencies": { diff --git a/package.json b/package.json index 806d135..61598e7 100644 --- a/package.json +++ b/package.json @@ -83,12 +83,12 @@ "overrides": { "protobufjs": "7.6.6", "undici": "8.10.2", - "brace-expansion": "5.0.9", + "brace-expansion": "5.0.12", "ws": "8.21.0", "@earendil-works/pi-coding-agent": { "protobufjs": "7.6.6", "undici": "8.10.2", - "brace-expansion": "5.0.9", + "brace-expansion": "5.0.12", "ws": "8.21.0", "@google/genai": { "protobufjs": "7.6.6", @@ -104,4 +104,4 @@ } } } -} \ No newline at end of file +} diff --git a/tests/paths.test.ts b/tests/paths.test.ts index 68a4386..2f9552a 100644 --- a/tests/paths.test.ts +++ b/tests/paths.test.ts @@ -14,8 +14,20 @@ import { resolveTelegramLocksPath, resolveTelegramTempDir, resolveTelegramRuntimeLogPath, + getTelegramDiagnosticsDisplayPaths, + resolveTelegramProfileTempFilePath, } from "../lib/paths.ts"; +test("Diagnostics use the resolved agent root and profile suffix", () => { + const agentDir = resolveAgentDir(); + for (const profile of [undefined, "work"]) { + assert.deepEqual(getTelegramDiagnosticsDisplayPaths(profile), { + state: resolveTelegramProfileTempFilePath("state", "json", agentDir, profile), + logs: resolveTelegramProfileTempFilePath("logs", "jsonl", agentDir, profile), + }); + } +}); + await test("resolveAgentDir", async (t) => { await t.test("returns PI_CODING_AGENT_DIR when env is set", () => { assert.equal( diff --git a/tests/time-injection.test.ts b/tests/time-injection.test.ts index 17d3ad7..f462102 100644 --- a/tests/time-injection.test.ts +++ b/tests/time-injection.test.ts @@ -47,6 +47,20 @@ test("Time config rejects non-positive interval", () => { assert.equal(resolved.interval, 60 * 60 * 1000); }); +test("Time config rejects non-finite intervals", () => { + for (const interval of [NaN, Infinity, -Infinity]) { + assert.equal(resolveTelegramTimeConfig({ injectionMode: "interval", interval }).interval, 3_600_000); + } +}); + +test("Time injection recovers when the wall clock moves backwards", () => { + const runtime = makeRuntime({ injectionMode: "interval", interval: 60_000, timezone: "UTC" }); + assert.ok(runtime.resolveLine(1, new Date("2026-05-16T15:00:00Z"))); + assert.ok(runtime.resolveLine(1, new Date("2026-05-16T14:00:00Z"))); + assert.equal(runtime.resolveLine(1, new Date("2026-05-16T14:00:30Z")), null); + assert.ok(runtime.resolveLine(1, new Date("2026-05-16T14:01:00Z"))); +}); + test("Time injection runtime returns null for every call when injectionMode is hidden", () => { const runtime = makeRuntime({ injectionMode: "hidden", timezone: "UTC" }); for (let i = 0; i < 5; i++) {