Skip to content

chore(release): v0.9.29 with project-scope parity across capture surfaces - #1141

Open
rohitg00 wants to merge 8 commits into
mainfrom
release/v0.9.29
Open

chore(release): v0.9.29 with project-scope parity across capture surfaces#1141
rohitg00 wants to merge 8 commits into
mainfrom
release/v0.9.29

Conversation

@rohitg00

@rohitg00 rohitg00 commented Aug 2, 2026

Copy link
Copy Markdown
Owner

Release PR for v0.9.29. Three things in one reviewable unit: the release mechanics, a fix for the count drift currently failing consistency on main, and the project-scope parity work we scoped after closing #1122.

Release mechanics

Project-scope parity (closes #903, closes #1135)

Every capture surface now resolves project the way the hooks' resolveProject does: AGENTMEMORY_PROJECT_NAME override, then git toplevel basename, then cwd basename. Previously the same repository fragmented into different memory buckets per agent:

  • OpenCode plugin sent the full worktree path as both project and cwd; now project is the canonical basename, cwd keeps the full path, and the resolution is done once at plugin init (no per-message git spawns)
  • Hermes plugin sent the raw cwd path as both fields (Hermes Agent Python plugin sends raw cwd path as project, not git basename (PR #687 gap) #1135)
  • Pi extension sent raw process.cwd()
  • JSONL replay took the last /-segment, which turned a Windows-recorded cwd into the entire raw path; it now splits on both separators
  • Filesystem watcher read a divergent AGENTMEMORY_PROJECT env name; it now prefers AGENTMEMORY_PROJECT_NAME and keeps the old name as a deprecated alias

Also fixed while in there: OpenCode file enrichment matched capitalized tool names (Read, Write) that OpenCode never sends, so it was silently dead; the set is lowercase now and matching is case-insensitive.

Tests

The #1125 fallback expectations are updated to basenames per the canonicalization, git-toplevel resolution is covered with a throwaway fixture repo (the #1138 pattern), and a new project-scope-parity suite covers replay's Windows paths and the watcher's env alias. Full suite 7235 passing, consistency 62, skills lint green. Hermes is Python and has no harness in this repo; the change is minimal and syntax-checked.

After merge: gh release create v0.9.29 publishes agentmemory, mcp, and fs-watcher via publish.yml.

Summary by CodeRabbit

  • New Features

    • Added project-aware session and observation tracking with Git-based detection and working-directory reporting.
    • Added support for importing version 0.9.29 exports.
    • Added safeguards for oversized exports, including actionable errors and HTTP 413 responses.
    • Added protection against starting a second instance on the same port.
  • Bug Fixes

    • Corrected project-name configuration, path handling, and file-tool detection.
    • Improved REST endpoint registration and reporting.
    • Unknown CLI commands now display an error instead of starting the server.
  • Documentation

    • Added the 0.9.29 changelog entry and updated REST API references.
  • Tests

    • Expanded coverage for project resolution, exports, CLI safeguards, and file-tool matching.

Version trio + plugin manifests + supportedVersions + ExportData union
bumped to 0.9.29; CHANGELOG entry covering everything since v0.9.28 with
upgrade notes for the four visible behavior changes.

Fixes the endpoint-count drift on main (130 registered routes vs docs
saying 129 after #1132 landed in parallel with #1136).

Project-scope parity: OpenCode plugin, Hermes plugin, Pi extension, and
JSONL replay now resolve project the same way the hooks do (env
override, git toplevel basename, cwd basename) instead of sending raw
filesystem paths, closing #903 and #1135 and pre-empting the same bug
in pi. The filesystem watcher accepts AGENTMEMORY_PROJECT_NAME with the
old AGENTMEMORY_PROJECT kept as a deprecated alias, replay handles
Windows-recorded paths, and OpenCode file enrichment matches the
agent's lowercase tool names (the capitalized set never matched).

Tests: opencode fallback expectations updated to basenames per the
canonicalization, git-toplevel resolution covered with a fixture repo,
new project-scope-parity suite for replay and fs-watcher.
@vercel

vercel Bot commented Aug 2, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
agentmemory Ready Ready Preview Aug 3, 2026 10:28am

Request Review

@coderabbitai

coderabbitai Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The 0.9.29 release updates version and export compatibility, canonicalizes project names across integrations, separates project and cwd payloads, preserves method-specific REST routes, updates endpoint documentation, adds CLI guards, and limits oversized export payloads.

Changes

Project Scope and Release

Layer / File(s) Summary
Project scope resolution across integrations
integrations/filesystem-watcher/watcher.mjs, integrations/hermes/__init__.py, integrations/pi/index.ts, src/replay/jsonl-parser.ts, test/project-scope-parity.test.ts
Project names resolve from environment values, Git repository basenames, or directory basenames. Session and observation payloads preserve the full cwd.
OpenCode scope and tool handling
plugin/opencode/agentmemory-capture.ts, test/opencode-auto-context.test.ts
OpenCode sends separate project and cwd values, uses the resolved project for context requests, and matches file tools case-insensitively.
0.9.29 version and import compatibility
package.json, src/version.ts, src/types.ts, src/functions/export-import.ts, test/export-import.test.ts, plugin/*/plugin.json, packages/mcp/package.json, test/consistency.test.ts, CHANGELOG.md
Version metadata, manifests, changelog content, and export validation now support 0.9.29.
REST endpoint generation and documentation
scripts/skills/generate.ts, AGENTS.md, README.md, plugin/skills/agentmemory-rest-api/REFERENCE.md, src/index.ts, CONTRIBUTING.md
Endpoint generation deduplicates by method and path. Documentation and startup output report 130 endpoints.
CLI startup and command guards
src/cli.ts, test/cli-second-instance-guard.test.ts
The CLI checks the live endpoint before startup and routes unknown positional commands to an error handler.

Payload Frame Guards

Layer / File(s) Summary
Frame-size validation contract
src/state/frame-guard.ts, test/frame-guard.test.ts
The frame guard measures UTF-8 JSON payload size, enforces a 15 MiB safe cap, and returns structured oversized-payload errors.
Export and mesh response protection
src/functions/export-import.ts, src/triggers/api.ts, test/frame-guard.test.ts
mem::export and mesh export reject oversized serialized responses. Mesh export returns HTTP 413, and export tests cover fitting and oversized payloads.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant MeshExport
  participant FrameGuard
  participant AgentmemoryStorage
  Client->>MeshExport: request export
  MeshExport->>AgentmemoryStorage: generate serialized payload
  AgentmemoryStorage-->>MeshExport: return export payload
  MeshExport->>FrameGuard: check UTF-8 payload size
  FrameGuard-->>MeshExport: return payload or oversized error
  MeshExport-->>Client: return export or HTTP 413
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The PR also adds CLI second-instance guards and frame-size protections, which are unrelated to linked issues #903 and #1135. Move unrelated CLI and frame-size changes to separate pull requests or link issues that define those requirements.
Docstring Coverage ⚠️ Warning Docstring coverage is 11.76% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the v0.9.29 release and its project-scope parity changes across capture surfaces.
Linked Issues check ✅ Passed The OpenCode and Hermes updates implement canonical project resolution and preserve the full working directory as cwd [#903] [#1135].
✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release/v0.9.29

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
integrations/pi/index.ts (1)

124-146: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove added behavioral comments from TypeScript files.

Use clear identifiers and test names instead of comments that restate implementation behavior.

  • integrations/pi/index.ts#L124-L146: remove comments that describe project resolution and the Git fallback.
  • src/replay/jsonl-parser.ts#L29-L31: remove the separator-handling comment.
  • test/project-scope-parity.test.ts#L6-L8: remove the project-scope behavior comment.
  • plugin/opencode/agentmemory-capture.ts#L5-L9: remove the file-tool matching comment.
  • plugin/opencode/agentmemory-capture.ts#L65-L88: remove comments that describe project state and Git fallback.
  • test/opencode-auto-context.test.ts#L90-L92: remove the canonicalization comment.
  • test/opencode-auto-context.test.ts#L114-L114: remove the Git-subdirectory behavior comment.
  • test/opencode-auto-context.test.ts#L125-L129: remove the file-tool behavior comment.

As per coding guidelines, “Do not add comments explaining what the code does; use clear naming instead.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@integrations/pi/index.ts` around lines 124 - 146, Remove behavioral comments
without changing implementation: in integrations/pi/index.ts, remove comments
around resolveProjectName; in src/replay/jsonl-parser.ts lines 29-31, remove the
separator-handling comment; in test/project-scope-parity.test.ts lines 6-8,
remove the project-scope comment; in plugin/opencode/agentmemory-capture.ts
lines 5-9 and 65-88, remove file-tool, project-state, and Git-fallback comments;
and in test/opencode-auto-context.test.ts lines 90-92, 114, and 125-129, remove
the canonicalization, Git-subdirectory, and file-tool behavior comments.
Preserve all code and test behavior.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@integrations/filesystem-watcher/watcher.mjs`:
- Around line 322-324: Update project resolution consistently across
integrations/filesystem-watcher/watcher.mjs:322-324,
src/replay/jsonl-parser.ts:27-32, and test/project-scope-parity.test.ts:21-60:
trim AGENTMEMORY_PROJECT_NAME (then deprecated AGENTMEMORY_PROJECT), resolve the
Git toplevel basename before falling back to the watched-root or cwd basename,
and apply the same override/Git-root order during replay when the recorded cwd
is accessible while retaining basename fallback for unavailable or
cross-platform paths. Add parity tests covering replay override, replay Git-root
resolution, and watcher Git-root resolution.

In `@plugin/skills/agentmemory-rest-api/REFERENCE.md`:
- Line 8: Regenerate plugin/skills/agentmemory-rest-api/REFERENCE.md using npm
run skills:gen after verifying the generator discovers all registered routes,
including the routes exposed through src/index.ts and src/triggers/api.ts.
Replace the incomplete 119-endpoint header and table with the complete generated
130-route block, preserving the generator’s output format.

---

Nitpick comments:
In `@integrations/pi/index.ts`:
- Around line 124-146: Remove behavioral comments without changing
implementation: in integrations/pi/index.ts, remove comments around
resolveProjectName; in src/replay/jsonl-parser.ts lines 29-31, remove the
separator-handling comment; in test/project-scope-parity.test.ts lines 6-8,
remove the project-scope comment; in plugin/opencode/agentmemory-capture.ts
lines 5-9 and 65-88, remove file-tool, project-state, and Git-fallback comments;
and in test/opencode-auto-context.test.ts lines 90-92, 114, and 125-129, remove
the canonicalization, Git-subdirectory, and file-tool behavior comments.
Preserve all code and test behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c0c6d7fc-acc2-4be1-bb79-b657fb451086

📥 Commits

Reviewing files that changed from the base of the PR and between 5023cf3 and 39b1e67.

📒 Files selected for processing (20)
  • AGENTS.md
  • CHANGELOG.md
  • README.md
  • integrations/filesystem-watcher/watcher.mjs
  • integrations/hermes/__init__.py
  • integrations/pi/index.ts
  • package.json
  • plugin/.claude-plugin/plugin.json
  • plugin/.codex-plugin/plugin.json
  • plugin/opencode/agentmemory-capture.ts
  • plugin/plugin.json
  • plugin/skills/agentmemory-rest-api/REFERENCE.md
  • src/functions/export-import.ts
  • src/index.ts
  • src/replay/jsonl-parser.ts
  • src/types.ts
  • src/version.ts
  • test/export-import.test.ts
  • test/opencode-auto-context.test.ts
  • test/project-scope-parity.test.ts

Comment thread integrations/filesystem-watcher/watcher.mjs Outdated
Comment thread plugin/skills/agentmemory-rest-api/REFERENCE.md Outdated
- skills generator dedupes routes on method plus path, so the REST
  reference lists all 130 registered routes instead of hiding the second
  method on ten dual-method paths (header said 119)
- fs-watcher trims AGENTMEMORY_PROJECT_NAME and the deprecated alias,
  treating whitespace as unset, and derives the git toplevel basename
  when watching a subdirectory
- replay resolves the git toplevel basename when the recorded cwd still
  exists locally (memoized per cwd), keeping the basename fallback for
  historical or cross-platform paths; no env override here since a bulk
  import spans many projects
- parity tests for replay git-root resolution, watcher git-root and
  trim behavior
- stat-tests badge updated from 1428+ to 1550+ passing

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
src/replay/jsonl-parser.ts (1)

29-59: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove explanatory implementation comments.

Lines 29, 37-41, and 55-56 explain implementation behavior. Remove these comments or retain only comments that document non-obvious constraints not represented by the code.

As per coding guidelines, src/**/*.{ts,tsx} must “avoid comments that explain what code does.”

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/replay/jsonl-parser.ts` around lines 29 - 59, Remove the explanatory
comments in and around deriveProject, including the projectByCwd memoization
note, git-resolution explanation, and path-splitting explanation. Keep the
implementation unchanged and retain only comments documenting genuinely
non-obvious constraints, if necessary.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@integrations/filesystem-watcher/watcher.mjs`:
- Around line 142-144: Update the project resolution in the watcher
initialization and flush flow: preserve config.project as an explicit override,
but when it is absent derive and store a project for each resolved root instead
of assigning only the first root’s project to this.project. In flush, select the
project associated with the emitted event’s rootDir, and add coverage using two
repositories to verify each event is scoped to its own project.

In `@src/replay/jsonl-parser.ts`:
- Around line 32-42: Validate the parsed JSON entry’s cwd before assigning it,
accepting only non-empty string values and otherwise leaving it unset or
defaulted. Update the entry-copying logic feeding deriveProject so invalid
truthy values such as objects never reach existsSync(cwd), while preserving
valid string handling and fallback behavior.

---

Nitpick comments:
In `@src/replay/jsonl-parser.ts`:
- Around line 29-59: Remove the explanatory comments in and around
deriveProject, including the projectByCwd memoization note, git-resolution
explanation, and path-splitting explanation. Keep the implementation unchanged
and retain only comments documenting genuinely non-obvious constraints, if
necessary.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 885e469c-20e2-43e4-a210-a4b476dc4367

📥 Commits

Reviewing files that changed from the base of the PR and between 39b1e67 and a8a6d1a.

⛔ Files ignored due to path filters (2)
  • assets/tags/light/stat-tests.svg is excluded by !**/*.svg
  • assets/tags/stat-tests.svg is excluded by !**/*.svg
📒 Files selected for processing (5)
  • integrations/filesystem-watcher/watcher.mjs
  • plugin/skills/agentmemory-rest-api/REFERENCE.md
  • scripts/skills/generate.ts
  • src/replay/jsonl-parser.ts
  • test/project-scope-parity.test.ts

Comment thread integrations/filesystem-watcher/watcher.mjs
Comment thread src/replay/jsonl-parser.ts
Closes the class behind issue 1140: agentmemory consolidate (or any
unrecognized word) fell through the command table into the full server
boot, registering a duplicate worker on the running engine; on iii
0.11.2 the second instance's shutdown tears down the daemon's HTTP
trigger routing until a full engine restart. Unknown subcommands now
error with the supported list, and main() probes livez on the resolved
port and refuses to boot over a live daemon, so multi-instance setups
on other ports are unaffected. Verified behaviorally against the built
CLI: both paths refuse with exit 1.

Also from review: the watcher stamps each event with its own root's
project via a per-root map (an explicit config.project still overrides
for every root), and replay only accepts a non-empty string cwd from
parsed JSONL so malformed entries cannot reach the filesystem probe.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/cli-second-instance-guard.test.ts (1)

13-28: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Cover the CLI guards at runtime, not just as text.

These Vitest assertions can pass while the dispatch or daemon guard is broken. Extract the handler/main decisions or invoke the CLI with mocked fetch, startEngine, and process.exit, then assert that an unknown positional command runs unknownCommand, a successful livez probe exits before startup, and a failed/disconnected probe continues startup.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/cli-second-instance-guard.test.ts` around lines 13 - 28, The tests in
“test/cli-second-instance-guard.test.ts” only inspect source text instead of
validating runtime behavior. Replace or supplement the string assertions around
the CLI handler and “main” flow with executable tests using mocked “fetch”,
“startEngine”, and “process.exit”; verify unknown positional commands invoke
“unknownCommand”, a successful “/agentmemory/livez” probe exits before startup,
and a failed or disconnected probe still starts the engine.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/cli-second-instance-guard.test.ts`:
- Around line 13-28: The tests in “test/cli-second-instance-guard.test.ts” only
inspect source text instead of validating runtime behavior. Replace or
supplement the string assertions around the CLI handler and “main” flow with
executable tests using mocked “fetch”, “startEngine”, and “process.exit”; verify
unknown positional commands invoke “unknownCommand”, a successful
“/agentmemory/livez” probe exits before startup, and a failed or disconnected
probe still starts the engine.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b0c4b5b1-53df-47a1-8fa7-71a66fa4b768

📥 Commits

Reviewing files that changed from the base of the PR and between a8a6d1a and 98403e1.

📒 Files selected for processing (5)
  • integrations/filesystem-watcher/watcher.mjs
  • src/cli.ts
  • src/replay/jsonl-parser.ts
  • test/cli-second-instance-guard.test.ts
  • test/project-scope-parity.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • src/replay/jsonl-parser.ts
  • test/project-scope-parity.test.ts

packages/mcp was still 0.9.28 after the release bump because nothing
guarded it; a consistency test now pins it to package.json. CONTRIBUTING
release list corrected to the files a bump actually touches (no tracked
lockfile, the two extra plugin manifests, the export test derives from
VERSION now), and the subsystems table gains src/cli, integrations/pi,
and the generated-manifest note.
Closes the availability bug in issue 1142: GET /agentmemory/export
assembles the full store and returns it through sdk.trigger, so a store
whose serialized export passes the engine's 16 MiB WebSocket frame
(tungstenite max_frame_size, not raisable under the 0.11.2 pin) dies on
the worker->engine hop, drops the worker, and 404s every endpoint for
~1s. The session collections page on maxSessions/offset but ~18 others
do not, so a large store hits this at any parameter combination.

A shared frame-guard measures the serialized size before returning:
mem::export returns a small oversized error instead of the giant
object, and api::mesh-export returns 413 (same dead-end as #890). Either
way the over-frame payload never crosses the boundary, so the daemon
stays up and the failure is one clean request with a hint to narrow the
range. Full pagination of the non-session collections is a follow-up.

Layer 1 of the fix; verified with a synthetic oversized export returning
the error object (tiny) rather than the payload.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/triggers/api.ts`:
- Around line 2793-2802: Update the export handler surrounding the oversized
payload check so the `memories` collection is filtered by the requested
`project`, matching the existing project filtering applied to `actions`, before
invoking `checkPayloadFrameSize`. Preserve unfiltered memories when no project
is provided, and add a regression test verifying that a project-scoped export
excludes memories from other projects and avoids the documented 413 scenario.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c1f24973-05ae-433e-88eb-73e0a200b7a6

📥 Commits

Reviewing files that changed from the base of the PR and between e8e81b3 and 22adc0d.

📒 Files selected for processing (5)
  • CHANGELOG.md
  • src/functions/export-import.ts
  • src/state/frame-guard.ts
  • src/triggers/api.ts
  • test/frame-guard.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • CHANGELOG.md

Comment thread src/triggers/api.ts
The two-step install (npm install --package-lock-only then npm ci) failed
only on the Node 24/26 matrix rows: their stricter npm rejects rolldown's
optional platform bindings (@rolldown/binding-android-arm64) that a
--package-lock-only pass does not fully enumerate. Lockfiles are gitignored,
so npm ci re-validation buys no reproducibility here. A single lenient
npm install resolves and installs in one pass.
api::mesh-export filtered actions by ?project but returned every project's
memories. On a mesh instance federating one project to a peer, the peer
pulled other projects' memories (cross-project leak), and those extras could
push the payload past the 16 MiB transport frame into a 413 even when the
requested project's own slice fit. Memories carry the same optional project
field as actions, so filter both before the frame-size guard runs.

Adds a regression test asserting a project-scoped export excludes other
projects' memories and that an oversized memory in another project no longer
413s the scoped request.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant