CodeSnuffler Forgejo End-to-End historical review range codesnuffler-forgejo-live-20260710T131023262Z-d22ba8a3-ecd #51

Closed

jason-admin wants to merge 2 commits from change_forgejo_end_to_end into base_forgejo_end_to_end

jason-admin commented

2026-07-10 13:11:35 +00:00

Owner

Exercise the live Forgejo webhook review pipeline against a stable historical CodeSnuffler diff.

Run marker: codesnuffler-forgejo-live-20260710T131023262Z-d22ba8a3-ecd.
Run started at: 2026-07-10T13:10:23.262Z.

Fixture range: f9d210eccd0075b6b39b606cea9b1376719aa062..d8a3fc420b055e04df1d203706b89b1f1261a9c1.
This stable two-commit AI Harness range is expected to produce actionable findings.

Exercise the live Forgejo webhook review pipeline against a stable historical CodeSnuffler diff. Run marker: codesnuffler-forgejo-live-20260710T131023262Z-d22ba8a3-ecd. Run started at: 2026-07-10T13:10:23.262Z. Fixture range: f9d210eccd0075b6b39b606cea9b1376719aa062..d8a3fc420b055e04df1d203706b89b1f1261a9c1. This stable two-commit AI Harness range is expected to produce actionable findings.

jason-admin added 2 commits

2026-07-10 13:11:35 +00:00

AI Harness: update tool auth contracts for plugin instances 11f109e6c2

This completes Step 12 of the AI harness plugin-instance plan by replacing the tool auth container session contract's persona field with explicit plugin instance identity. Controller request and response schemas, auth image refs, build payloads, dev-shell websocket forwarding, Docker labels, container env, and shared probe metadata now carry plugin_id, instance_id, and driver_id.

The controller now rejects mismatched plugin or driver identity, uses PLUGIN_INSTANCE_ID instead of TOOL_PERSONA_ID in auth containers, and labels containers/images with current plugin and driver keys. The app-side auth container client and session helpers send the new payload shape without accepting the old persona_id request field.

Validated with: pytest for the container image controller client, AI tool auth containers, and container image controller integration files; compileall for touched controller/app/contract/test modules; git diff --check; targeted cleanup search for removed tool-auth persona fields, env vars, labels, and probe keys in the edited boundary.

AI Harness: update runtime status projections for plugin instances d8a3fc420b

Update the AI harness runtime/status layer to project current plugin instance identity through auth runtime summaries, raw probe normalization, storage inventory, setup details, generic auth helpers, and system report rows. Runtime/status models now carry plugin_id, instance_id, and driver_id without a persona_id field, while later runner and review-policy persona cleanup remains explicitly scoped to follow-up plan steps.

Validated with: pytest for the AI tool instance suite, focused homepage runtime/status cases, the configured harness plugin catalog case, AI tool schema unit tests, compileall for the touched backend/test modules, git diff --check, and targeted persona cleanup searches.

jason-admin commented

2026-07-10 13:11:44 +00:00

Author

Owner

CodeSnuffler Review Findings

Recommendation	Risk	Open findings	Files touched by findings
Request Changes	Medium	3	3

Findings

1. Dev shell auth sessions ignore selected non-primary instances

Severity	Category	Confidence	Location	Status
Medium	Correctness	95%	`frontend/src/dev-shell/components/DevShellTerminal.vue:155`	Open

dev_shell_websocket now reads only the instance_id query parameter, but the frontend terminal still sends persona_id. Interactive runner auth launched from setup flows will fall back to primary instead of the selected plugin instance.

Open finding in CodeSnuffler

Fix via CodeSnuffler

Suggested fix: Send instance_id here and rename the prop/uses away from personaId so callers pass the selected plugin instance id under the new contract.

2. Removed persona contract remains as a runtime compatibility shim

Severity	Category	Confidence	Location	Status
Medium	Maintainability	98%	`app/ai_tools/instances.py:226-227`	Open

The repository policy requires removing runtime reads and compatibility paths when standardizing a field. This property keeps persona_id alive and existing runtime code still calls it, so stale persona_id usage remains hidden instead of being converted to instance_id.

Open finding in CodeSnuffler

Fix via CodeSnuffler

Suggested fix: Remove the persona_id property and update remaining runtime consumers such as workspace/storage deletion paths to use config.instance_id directly.

3. AI review policy API still exposes persona_id

Severity	Category	Confidence	Location	Status
Medium	Correctness	92%	`app/settings/ai_review_policy/schemas.py:72-77`	Open

The AI review policy choice response still publishes persona_id, so the old field remains in a live API schema and generated frontend types. This violates the no-shim cleanup rule and leaves clients on the obsolete naming after this standardization.

Open finding in CodeSnuffler

Fix via CodeSnuffler

Suggested fix: Replace persona_id with current identity fields, at minimum instance_id and preferably the same plugin_id/instance_id/driver_id shape used elsewhere, then regenerate frontend API types and update consumers.

![CodeSnuffler review banner](https://development.codesnuffler.com/codesnuffler_review/assets/banner_mediumIssues) ## CodeSnuffler Review Findings | Recommendation | Risk | Open findings | Files touched by findings | | --- | --- | ---: | ---: | | Request Changes | Medium | 3 | 3 | ### Findings #### 1. Dev shell auth sessions ignore selected non-primary instances | Severity | Category | Confidence | Location | Status | | --- | --- | ---: | --- | --- | | Medium | Correctness | 95% | `frontend/src/dev-shell/components/DevShellTerminal.vue:155` | Open | `dev_shell_websocket` now reads only the `instance_id` query parameter, but the frontend terminal still sends `persona_id`. Interactive runner auth launched from setup flows will fall back to `primary` instead of the selected plugin instance. [Open finding in CodeSnuffler](https://development.codesnuffler.com/codesnuffler_review/forgejo-jason-admin-CodeSnuffler-FJ-pr-51/findings/2) [Fix via CodeSnuffler](https://development.codesnuffler.com/codesnuffler_review/forgejo-jason-admin-CodeSnuffler-FJ-pr-51/findings/2/fix) **Suggested fix:** Send `instance_id` here and rename the prop/uses away from `personaId` so callers pass the selected plugin instance id under the new contract. #### 2. Removed persona contract remains as a runtime compatibility shim | Severity | Category | Confidence | Location | Status | | --- | --- | ---: | --- | --- | | Medium | Maintainability | 98% | `app/ai_tools/instances.py:226-227` | Open | The repository policy requires removing runtime reads and compatibility paths when standardizing a field. This property keeps `persona_id` alive and existing runtime code still calls it, so stale `persona_id` usage remains hidden instead of being converted to `instance_id`. [Open finding in CodeSnuffler](https://development.codesnuffler.com/codesnuffler_review/forgejo-jason-admin-CodeSnuffler-FJ-pr-51/findings/3) [Fix via CodeSnuffler](https://development.codesnuffler.com/codesnuffler_review/forgejo-jason-admin-CodeSnuffler-FJ-pr-51/findings/3/fix) **Suggested fix:** Remove the `persona_id` property and update remaining runtime consumers such as workspace/storage deletion paths to use `config.instance_id` directly. #### 3. AI review policy API still exposes persona_id | Severity | Category | Confidence | Location | Status | | --- | --- | ---: | --- | --- | | Medium | Correctness | 92% | `app/settings/ai_review_policy/schemas.py:72-77` | Open | The AI review policy choice response still publishes `persona_id`, so the old field remains in a live API schema and generated frontend types. This violates the no-shim cleanup rule and leaves clients on the obsolete naming after this standardization. [Open finding in CodeSnuffler](https://development.codesnuffler.com/codesnuffler_review/forgejo-jason-admin-CodeSnuffler-FJ-pr-51/findings/4) [Fix via CodeSnuffler](https://development.codesnuffler.com/codesnuffler_review/forgejo-jason-admin-CodeSnuffler-FJ-pr-51/findings/4/fix) **Suggested fix:** Replace `persona_id` with current identity fields, at minimum `instance_id` and preferably the same `plugin_id`/`instance_id`/`driver_id` shape used elsewhere, then regenerate frontend API types and update consumers.

jason-admin referenced this pull request

2026-07-10 13:14:37 +00:00

CodeSnuffler fix codesnuffler-forgejo-live-20260710T131023262Z-d22ba8a3-ecd #52

jason-admin closed this pull request

2026-07-10 13:15:07 +00:00