Repository navigation
feat(security): M14.8 advisories in the agent's context (+ swarm_context route fix) - #214
Merged
Merged
Conversation
…m_context route fix store.advisoryContextLine: the project's open advisory hits, worst first, one per package and version, at most six, each with its fixed version and the advisory id, as one "[swarm] known advisories in this project's lockfiles" line in sessionContext — so both the SessionStart hook and swarm_context (/v1/context) carry it. Null while advisories are off or the project is clean. vulnerable_install joins the rule modes the context names. Found by the new test: /v1/context was registered twice and Hono answered from the first (the M9.6 context-waste report), so swarm_context had always received a report without `text` and said "nothing to report". One handler now serves both: `cwd` picks the session context, its absence the report. Docs: roadmap M14.8 flipped (with the bug noted); the Observatory guide; CLAUDE.md. Verified: typecheck · lint · test (1075 pass) · smoke · docs:check. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #213 (M14.5). The first of the three tasks added after the review: agents learn about advisories before a rule has to ask.
What it does
store.advisoryContextLine— the project's open advisories, worst first, one per package and version, at most six, each with the fixed version and the advisory id — joinssessionContext, so theSessionStarthook andswarm_contextboth carry it. Null while advisories are off or the project is clean.vulnerable_installis now among the rule modes the context names.A bug the test found.
/v1/contextwas registered twice and Hono answered from the first registration (the Observatory context-waste report), so theswarm_contextMCP tool had always received a body withouttextand answered nothing to report. One handler now serves both:cwdselects the session context, its absence the report. The M7.10 route is reachable again.Verification: typecheck · lint · test (1075 pass) · smoke · docs:check. The daemon test drives the fake OSV: the line appears in
sessionContextand through/v1/context?cwd=, and is absent while the switch is off.🤖 Generated with Claude Code