Skip to content

Fix 20 bugs from full codebase review#161

Merged
gvonness-apolitical merged 1 commit intomainfrom
fix/codebase-review-v0.10.1
Mar 13, 2026
Merged

Fix 20 bugs from full codebase review#161
gvonness-apolitical merged 1 commit intomainfrom
fix/codebase-review-v0.10.1

Conversation

@gvonness-apolitical
Copy link
Copy Markdown
Contributor

Summary

Full multi-agent codebase review across all 14 production modules (v0.10.1). Each module was reviewed by parallel specialist agents (bug hunter, guidelines, error handling, architecture, test coverage) with independent verification scoring (threshold ≥80).

20 fixes applied across 20 files:

  • Config (critical): getConfig() returned defaults at all entry points, ignoring user config files and env vars. Added initRuntimeConfig() cache and wired it into MCP server, hooks, and dashboard. Also added NaN validation for parseInt/parseFloat from env vars, and range checks for clusterHour/halfLifeHours/decayFactor.
  • Ingest (critical): findDebriefTurn returned array index instead of turn.index, silently breaking debrief edge creation during incremental ingestion.
  • MCP: days_back: 0 silently overrode explicit from/to; missing params validation on tools/call; parse error used id: 0 instead of id: null (JSON-RPC 2.0 spec).
  • Storage: Memory leak in vector index cleanup; stale projectsCache on delete; hash collision from truncated base64; missing transaction wrapper; unsafe catch-all error handling.
  • Retrieval: anyChildEmitted set unconditionally in chain-walker DFS for agent-filtered/oversized branches.
  • Hooks: Session-start fallback defined but never passed to executeHook(); withRetry() never updated metrics.retryCount.

Cross-cutting patterns identified:

  1. Config initialization bypass — 3 entry points affected (same root cause)
  2. Array index vs semantic index confusion — 2 instances in debrief detector
  3. Input validation gaps at system boundaries — 3 instances (env vars, JSON-RPC)

Test plan

  • All 2559 tests pass
  • TypeScript build clean
  • ESLint + Prettier clean
  • Verify config changes load correctly in production (npx causantic health)
  • Verify debrief edges created correctly during incremental ingestion

Multi-agent review across all 14 production modules with independent
verification scoring. Key fixes:

- Config: getConfig() bypassed user config at all entry points; add
  initRuntimeConfig() cache, wire to MCP server/hooks/dashboard
- Config: parseInt/parseFloat NaN from env vars not validated
- Ingest: findDebriefTurn returned array index instead of turn.index,
  breaking debrief edges during incremental ingestion
- MCP: days_back=0 silently overrode explicit from/to date filters
- MCP: missing params validation on tools/call JSON-RPC handler
- MCP: parse error response used id:0 instead of id:null (JSON-RPC spec)
- Storage: memory leak in vector index cleanup, stale projectsCache,
  hash collision in cluster membership, missing transaction wrapper
- Retrieval: anyChildEmitted set unconditionally in chain-walker DFS
- Hooks: session-start fallback never passed to executeHook();
  withRetry() never updated metrics.retryCount
@gvonness-apolitical gvonness-apolitical merged commit ba93e87 into main Mar 13, 2026
3 checks passed
@gvonness-apolitical gvonness-apolitical deleted the fix/codebase-review-v0.10.1 branch March 13, 2026 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant