Conversation
Hybrid script + agent skill that runs build/typecheck/Playwright E2E tests on PRs and posts structured review comments via gh CLI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- gh pr diff --stat doesn't exist; use gh pr view --json additions,deletions - Fix unicode double-escaping in format-fallback.js (\\u → \u) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use git status -uno to avoid false positives from untracked skill dirs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Automated PR ReviewCommit: Check Summary
Failed Tests❌ Playwright Configuration Error (playwright.config.ts)VerdictGenerated by auto-pr-review skill (static fallback) | VibeLab |
Detects if localhost:5173 is up. If not, starts npm run dev in background, waits up to 60s, then runs tests. Cleans up after. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Automated PR ReviewCommit: Check Summary
Failed Tests❌ should auto-generate workspace name when opening folder browser (auto-workspace-name.spec.ts)Screenshot: ❌ API accepts workspace creation under ~/Documents (outside ~/vibelab) (custom-workspace-path.spec.ts)❌ file path regex correctly identifies file paths (markdown-file-links.spec.ts)Screenshot: ❌ Markdown component renders file paths as clickable buttons (markdown-file-links.spec.ts)Screenshot: ❌ file path parsing extracts path and line number correctly (markdown-file-links.spec.ts)Screenshot: ❌ verify Markdown module includes onFileOpen handling via Vite (markdown-file-links.spec.ts)Screenshot: ❌ 1. "Import Your Local Skills" button is removed (skills-refactor.spec.ts)Screenshot: VerdictGenerated by auto-pr-review skill (static fallback) | VibeLab |
Critical: - #1 Shell escape API key values in community-tools.env export - #2 Replace ComputeNode.exec() with ComputeNode.run() (correct method) High: - #3 Add path traversal validation in status endpoint - #4 Sanitize SSH user/host to prevent shell injection - #5 Use i18n key for "Auto Research" sidebar button - #6 Add Auto Research button to mobile sidebar - #10 Stop leaking error.message to clients in 500 responses
Critical: - #1 Shell escape API key values in community-tools.env export - #2 Replace ComputeNode.exec() with ComputeNode.run() (correct method) High: - #3 Add path traversal validation in status endpoint - #4 Sanitize SSH user/host to prevent shell injection - #5 Use i18n key for "Auto Research" sidebar button - #6 Add Auto Research button to mobile sidebar - #10 Stop leaking error.message to clients in 500 responses
…r fixes Fixes for PR OpenLAIR#146 review by @Zhang-Henry: Critical: - OpenLAIR#1: memory_enabled is now per-user (column on users table) instead of global app_settings. Each user controls their own memory toggle. - OpenLAIR#2: ~/.claude/MEMORY.md namespaced as MEMORY-{userId}.md to prevent multi-user overwrites on shared servers. High: - OpenLAIR#3: req.params.id validated as positive integer with parseInt + isNaN guard - OpenLAIR#4: Memory content sanitized (strip markdown headings) before prompt injection; content length capped at 500 chars; max 50 memories per user - OpenLAIR#5: Content length validation (400 error) on create and update routes - OpenLAIR#6: Delete now requires window.confirm() before executing Medium: - OpenLAIR#8: Removed no-op try/catch wrappers from all memoryDb methods - OpenLAIR#9: Added comment explaining why Gemini injects memory into user prompt (CLI has no system instruction API) - OpenLAIR#10: Changed index from (is_enabled) to composite (user_id, is_enabled) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
Test plan
review-pr.shagainst this PR