feat: add Hermes-inspired continuity and autonomy tools - #19
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 489ceab43e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| channelId: targetChannel.id, | ||
| agentId: input.targetAgentId, | ||
| title, | ||
| ...(parent ? { parentRunId: parent.taskRunId } : {}), |
There was a problem hiding this comment.
Every nested delegation passes the parent task as parentRunId, but channels.create always creates a fresh target channel while RunStore.create requires the parent run to belong to that same channel (server/src/runs/store.ts lines 512-523). Consequently, creating any delegation with parentDelegationId fails before the delegation is inserted, so the advertised nested-handoff flow cannot create a child run.
Useful? React with 👍 / 👎.
| ...(await governedProgramTools({ | ||
| tools: granted, | ||
| actor, |
There was a problem hiding this comment.
For a non-deterministic routine whose allowedTools includes openbot_run_tool_program, the wrapper is constructed over the complete granted set here and only the wrapper's outer name is filtered later. An approved program can therefore invoke granted tools omitted from the routine allowlist, bypassing the routine safeguard; build the wrapper from the filtered grants or reject programs containing excluded steps.
AGENTS.md reference: AGENTS.md:L84-L84
Useful? React with 👍 / 👎.
| const id = `${Date.now().toString(36)}-${crypto.randomUUID()}`; | ||
| const directory = checkpointDirectory(rootPath); | ||
| await mkdir(directory, { recursive: true }); | ||
| if (info) await copyFile(full, checkpointBlob(rootPath, id)); |
There was a problem hiding this comment.
When a workspace contains a file symlink pointing outside its root, write-path resolution validates only the parent directory, and this copyFile follows the symlink and saves the external target's contents as a checkpoint blob. The subsequently exposed checkpoint-diff endpoint returns that blob, creating a read/exfiltration path for host or container files that ordinary workspace reads correctly reject.
AGENTS.md reference: AGENTS.md:L84-L84
Useful? React with 👍 / 👎.
| if (safeguards.deterministic === true) { | ||
| const program = safeguards.toolProgramId; | ||
| if (typeof program !== "string" || !program.trim()) { | ||
| return { | ||
| ok: false, | ||
| message: "A deterministic routine requires a reviewed tool program.", | ||
| }; | ||
| } |
There was a problem hiding this comment.
For a deterministic routine, preflight only checks that toolProgramId is a nonempty string, so nonexistent, draft, another coworker's, or another owner's program is accepted and stored with preflightStatus: "passed". Every dispatch then fails in executeApprovedProgram; creation/update should verify that the referenced program is currently approved for this owner and routine agent while retaining the runtime recheck for later revocation.
Useful? React with 👍 / 👎.
| if (Number(counts?.total ?? 0) >= parent.maxChildren) { | ||
| throw new WorkConflictError( | ||
| `This handoff already has its maximum of ${parent.maxChildren} children.`, | ||
| ); | ||
| } | ||
| if (Number(counts?.active ?? 0) >= parent.maxParallel) { | ||
| throw new WorkConflictError( | ||
| `This handoff already has ${parent.maxParallel} children running in parallel.`, |
There was a problem hiding this comment.
When two child-delegation requests for the same parent execute concurrently, both can observe counts below maxChildren and maxParallel here and then both insert after the check. This permits the bounded handoff tree to exceed either configured limit; the count check and insertion need a shared transaction/parent lock or another atomic database constraint.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
Full lint completed with 24 pre-existing warnings in unrelated files. The full test run reached 780 passing and 5 skipped; 83 environment-dependent failures require PostgreSQL, Windows symlink privileges, or hit an existing Windows path-normalization case.