sync: v11 hardening and upstream base pin - #42
Conversation
|
Warning Review limit reached
Next review available in: 54 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR updates thin-fork verification, adds upstream attribution, introduces product-prefixed configuration aliases, rejects subscription-backed models, disables telemetry by default, preserves exported environment variables, adds Git timeouts, and removes redundant type casts. ChangesFork controls and runtime boundaries
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Environment
participant Adapter
participant Settings
participant EntryPoint
Environment->>Adapter: Supply exported or .env configuration
Adapter->>Settings: Build product-prefixed aliases from the schema
Settings-->>EntryPoint: Resolve model and runtime settings
EntryPoint->>EntryPoint: Reject subscription-backed models before sandbox setup
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Line 43: Update the verification instructions in CONTRIBUTING.md at lines
43-43 and docs/contributing.mdx at lines 15-15 to state that every changed
strix/ path requires either an attribution banner or a matching UPGRADES.md
ledger entry, replacing the banner-only wording in both locations.
In `@docs/advanced/configuration.mdx`:
- Around line 126-128: The LYRASHIELD_APP_URL configuration documentation
currently exposes the legacy Strix relay as its default. Update the ParamField
default or configuration guidance to use a LyraShield-owned relay endpoint, or
require explicit LyraShield configuration, so email verification and encrypted
report delivery cannot implicitly target STRIX_APP_URL.
In `@lyrashield_adapter/cli.py`:
- Around line 52-66: Update prepare_environment() so the STRIX_TELEMETRY
fallback is assigned only when the user has not already provided an explicit
telemetry setting, preserving both LYRASHIELD_TELEMETRY and STRIX_TELEMETRY
values while retaining the existing default of "0".
In `@pyproject.toml`:
- Around line 99-102: Update the [tool.mypy] exclude list in pyproject.toml to
remove strix/interface/tui while preserving the tests exclusion, so the existing
mypy directory gate checks the TUI source.
In `@scripts/verify-thin-fork.sh`:
- Around line 23-29: Update the validation flow in verify-thin-fork.sh to fetch
"$BASE" from the upstream remote on every run, rather than only when git
cat-file finds a local object. After fetching, validate that "$BASE" resolves
specifically to a commit object, rejecting trees, blobs, tags, or failed fetches
before continuing.
In `@strix/telemetry/__init__.py`:
- Around line 1-9: Set STRIX_TELEMETRY to "0" in the CLI entry-point flow
immediately before invoking upstream main(), ensuring it occurs before any
settings resolution; also add a guard that rejects telemetry.enabled whenever
LYRASHIELD_PRODUCT_BOUNDARY is set, using the existing settings-loading and
entry-point symbols.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 97a9f859-ee13-477b-b8f5-6d6c2eeb70d7
📒 Files selected for processing (49)
.lyrashield-upstream-baseCONTRIBUTING.mdMakefileREADME.mdUPGRADES.mddocs/advanced/configuration.mdxdocs/advanced/skills.mdxdocs/contributing.mdxdocs/cost-cache-engine-plan.mddocs/index.mdxdocs/llm-providers/azure.mdxdocs/llm-providers/openai.mdxdocs/llm-providers/overview.mdxdocs/p4-endpoint-enablement.mddocs/usage/cli.mdxdocs/usage/instructions.mdxlyrashield_adapter/cli.pypyproject.tomlscripts/verify-thin-fork.shstrix/agents/factory.pystrix/agents/prompt.pystrix/config/codex.pystrix/config/models.pystrix/config/settings.pystrix/core/agents.pystrix/core/execution.pystrix/core/inputs.pystrix/core/runner.pystrix/core/sessions.pystrix/interface/auth_cli.pystrix/interface/cli.pystrix/interface/main.pystrix/interface/provider_contract_cli.pystrix/interface/tui/app.pystrix/interface/utils.pystrix/provider_contract.pystrix/report/sarif.pystrix/report/state.pystrix/report/usage.pystrix/report/writer.pystrix/runtime/docker_client.pystrix/runtime/session_manager.pystrix/telemetry/__init__.pystrix/telemetry/_common.pystrix/telemetry/posthog.pystrix/telemetry/scarf.pystrix/viewer/server.pystrix/viewer/transcript.pytests/test_lyrashield_adapter.py
💤 Files with no reviewable changes (4)
- docs/p4-endpoint-enablement.md
- docs/cost-cache-engine-plan.md
- strix/report/state.py
- strix/config/models.py
1 participant
Pushes the local v11 hardening commit and the upstream-base pin to main.
Commits:
Summary by CodeRabbit
New Features
.envvalues.Bug Fixes
Documentation