Skip to content

fix(pi): recover submit-missing in session and surface triage verdicts#1535

Merged
getlarge merged 2 commits into
mainfrom
issue-1528-submit-missing-reprompt
Jun 30, 2026
Merged

fix(pi): recover submit-missing in session and surface triage verdicts#1535
getlarge merged 2 commits into
mainfrom
issue-1528-submit-missing-reprompt

Conversation

@legreffier

@legreffier legreffier Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Why

Dogfood failure on the run_eval producer lane (task b2d3c26f, profile il1395-gemma, gemma4:31b-cloud): the attempt failed in output_validation with

Agent did not satisfy the promised submit-output criterion: no valid task submit tool call was captured before the session ended.

This is the third submit-output recovery class called out in #1528 (comment). The in-session retry shipped earlier only covered:

  1. invalid submit args → tool returns isError, model re-calls; and
  2. provider/LLM API errorspromptWithProviderErrorRetries re-prompts.

A weaker model that ends its turn with prose and never calls the submit tool at all matched neither path (getCaptured() and getExhaustedValidationFailure() both null), so the executor fell straight to submit_output_missing and stranded the lane.

What

libs/pi-extension

  • New promptUntilSubmitted: after a clean pass with no captured output and no exhausted validation budget, re-prompt the same session (default ) naming the exact submit tool and forbidding a prose reply. Each re-prompt inherits the existing provider-error / cancel / cap handling. Strict re-prompt-then-fail — a model that still refuses fails with submit_output_missing as before.
  • buildSubmitMissingPrompt, maxSubmitMissingReprompts / submitMissingPrompt opts, toolName on the submit handle, and a submit_missing_reprompt info event.

apps/agent-daemon

  • submit_output_missing is now deterministically non-retryable: the runtime already re-prompts within the attempt, so a fresh attempt against the same model is unlikely to differ (addresses "why did maxAttempts: 2 not recover").
  • attempt-failure-classified now logs the structured triage verdict (source, code, retryable, decision, confidence, reason) instead of an opaque :source suffix. FinalizeContext.log takes a fields object; once.ts / poll-shared.ts wiring updated.

Already handled (no change here)

The Go CLI decode TaskAttemptError: unexpected field "retry" from the issue comment was fixed by 4010ad8d (regenerated clients) and is in released cli-v1.58.0 — re-running moltnet task attempts b2d3c26f... now decodes.

Tests

TDD throughout: 9 new promptUntilSubmitted cases + buildSubmitMissingPrompt + toolName + the non-retryable classification + the structured-log assertion. lint, test, typecheck green for @themoltnet/pi-extension and @themoltnet/agent-daemon; nx affected clean.

Refs #1528

Close the third submit-output recovery gap from #1528. The existing
in-session retry only covered (1) invalid submit args and (2) provider
errors. A weaker model that ends its turn with prose and never calls the
submit tool at all left the attempt to fail straight to
`submit_output_missing` with no recovery — the exact dogfood failure on
the run_eval producer lane.

pi-extension:
- Add `promptUntilSubmitted`: after a clean pass with no captured output
  and no exhausted validation budget, re-prompt the same session (default
  3x) naming the submit tool and forbidding a prose reply. Each re-prompt
  inherits the existing provider-error / cancel / cap handling. Strict
  re-prompt-then-fail: a model that still refuses fails with
  `submit_output_missing` as before.
- `buildSubmitMissingPrompt`, `maxSubmitMissingReprompts` /
  `submitMissingPrompt` opts, `toolName` on the submit handle, and a
  `submit_missing_reprompt` info event.

agent-daemon:
- `submit_output_missing` is now deterministically non-retryable: the
  runtime already re-prompts within the attempt, so a fresh attempt
  against the same model is unlikely to differ.
- `attempt-failure-classified` logs the structured verdict
  (source, code, retryable, decision, confidence, reason) instead of an
  opaque `:source` suffix; `FinalizeContext.log` now takes a fields object.

Refs #1528
@github-actions

Copy link
Copy Markdown
Contributor

✅ CLI go.mod matches internal Go module releases

apps/moltnet-cli/go.mod is aligned with the versions tracked in .release-please-manifest.json.

@github-actions

Copy link
Copy Markdown
Contributor

🚨 Dependency Audit — Vulnerabilities found

Full report
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Incomplete fix for CVE-2023-48223: JWT       │
│                     │ Algorithm Confusion via Whitespace-Prefixed RSA Public │
│                     │ Key                                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mvf2-f6gm-w987      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Cache Confusion via cacheKeyBuilder          │
│                     │ Collisions Can Return Claims From a Different Token    │
│                     │ (Identity/Authorization Mixup)                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=0.0.1 <6.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-rp9m-7r4c-75qg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ Arbitrary code execution in protobufjs                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.0.1                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xq3m-2v4x-88gg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: JWT auth bypass due to empty HMAC secret     │
│                     │ accepted by async key resolver                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.2.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-gmvf-9v4p-v8jc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-jwt accepts unknown `crit` header extensions (RFC │
│                     │ 7515 violation)                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm7r-c7qw-ghp6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code injection through bytes field        │
│                     │ defaults in generated toObject code                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-66ff-xgx4-vchm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code generation gadget after prototype    │
│                     │ pollution                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-75px-5xx7-5xc7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Process-wide denial of service through    │
│                     │ unsafe option paths                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jvwf-75h9-cwgg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Denial of service through unbounded       │
│                     │ protobuf recursion                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-685m-2w69-288q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobufjs: Denial of service through unbounded Any    │
│                     │ expansion during JSON conversion                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.4.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.4.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-wcpc-wj8m-hjx6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to TLS certificate validation bypass │
│                     │ via dropped requestTls in SOCKS5 ProxyAgent            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vmh5-mc38-953g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to TLS certificate validation bypass │
│                     │ via dropped requestTls in SOCKS5 ProxyAgent            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.23.0 <7.28.0                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vmh5-mc38-953g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via cumulative fragment bypass                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-38rv-x7px-6hhq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via fragment count bypass                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vxpw-j846-p89q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via fragment count bypass                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vxpw-j846-p89q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to cross-origin request routing via  │
│                     │ SOCKS5 proxy pool reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.23.0 <7.28.0                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm92-r4w5-c3mj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt has a ReDoS when using RegExp in allowed*     │
│                     │ leading to CPU exhaustion during token verification    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0 <=6.2.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-cjw9-ghj4-fwxf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt: Stateful RegExp (/g or /y) causes            │
│                     │ non-deterministic allowed-claim validation (logical    │
│                     │ DoS)                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <6.2.1                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-3j8v-cgw4-2g6q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ ip-address has XSS in Address6 HTML-emitting methods   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ ip-address                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=10.1.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>express-rate- │
│                     │ limit>ip-address                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v2v4-37r5-5v8g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Denial of service from crafted field      │
│                     │ names in generated code                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2pr8-phx7-x9h3      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Prototype injection in generated message  │
│                     │ constructors                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fx83-v9x8-x52w      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs has overlong UTF-8 decoding                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q6x5-8v7m-xcrf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs: Denial of Service via unbounded recursive  │
│                     │ JSON descriptor expansion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jggg-4jg4-v7c6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ uuid: Missing buffer bounds check in v3/v5/v6 when buf │
│                     │ is provided                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ uuid                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <11.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=11.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>mqemitter-      │
│                     │ redis>hyperid>uuid                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-w5hq-g745-h8pq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs : Schema-derived names can shadow           │
│                     │ runtime-significant properties                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.5.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.6.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f38q-mgvj-vph7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ OpenTelemetry Core: Unbounded memory allocation in W3C │
│                     │ Baggage propagation                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @opentelemetry/core                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <2.8.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=2.8.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/core                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-8988-4f7v-96qf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to HTTP header injection via         │
│                     │ Set-Cookie percent-decoding                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p88m-4jfj-68fv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to HTTP header injection via         │
│                     │ Set-Cookie percent-decoding                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p88m-4jfj-68fv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to cross-user information disclosure │
│                     │ via shared cache whitespace bypass                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pr7r-676h-xcf6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to cross-user information disclosure │
│                     │ via shared cache whitespace bypass                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pr7r-676h-xcf6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ Elliptic Uses a Cryptographic Primitive with a Risky   │
│                     │ Implementation                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ elliptic                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.6.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ libs__auth>get-jwks>jwk-to-pem>elliptic                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-848j-6mx2-7j84      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to HTTP response queue poisoning via │
│                     │ keep-alive socket reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-35p6-xmwp-9g52      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to HTTP response queue poisoning via │
│                     │ keep-alive socket reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-35p6-xmwp-9g52      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to Set-Cookie SameSite attribute     │
│                     │ downgrade via permissive substring matching            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-g8m3-5g58-fq7m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to Set-Cookie SameSite attribute     │
│                     │ downgrade via permissive substring matching            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-g8m3-5g58-fq7m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
35 vulnerabilities found
Severity: 5 low | 14 moderate | 12 high | 4 critical

@github-actions

github-actions Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

⚠️ Knip — Unused code or dependencies found

Run pnpm run knip locally to see details, or pnpm run knip:fix to auto-fix some of them.

Full report
�[93m�[4mUnused files�[24m�[39m (41)
.agents/skills/monitor-ci/scripts/ci-poll-decide.mjs                                       
.agents/skills/monitor-ci/scripts/ci-state-update.mjs                                      
apps/agent-daemon/src/lib/sandbox.ts                                                       
apps/console/e2e/seed-diary-browser.ts                                                     
apps/landing/src/hooks/useFeedSSE.ts                                                       
apps/mcp-host/server.mjs                                                                   
apps/mcp-host/src/sandbox.ts                                                               
apps/mcp-server/src/schemas/index.ts                                                       
apps/rest-api/src/migrate.ts                                                               
apps/rest-api/src/sse/public-feed-poller.ts                                                
apps/rest-api/src/sse/sse-writer.ts                                                        
apps/rest-api/src/typebox-schema-id.d.ts                                                   
docs/.vitepress/env.d.ts                                                                   
evals/moltnet-practices/auth-middleware-early-return/fixtures/auth-plugin.ts               
evals/moltnet-practices/auth-middleware-early-return/fixtures/team-resolver.ts             
evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/sdk.gen.ts                    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/consolidate-workflow.ts    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/diary-entry.repository.ts  
evals/moltnet-practices/rest-error-boundary/fixtures/pack-routes.ts                        
evals/moltnet-practices/rest-error-boundary/fixtures/verification-routes.ts                
evals/moltnet-practices/webhook-auth-status-code/fixtures/hooks.ts                         
examples/diary-create.ts                                                                   
examples/diary-search.ts                                                                   
examples/register.ts                                                                       
examples/sign-entry.ts                                                                     
test-fixtures/generate-ssh-vectors.mjs                                                     
test-fixtures/generate-x25519-vectors.mjs                                                  
tools/db/backfill-content-hashes.ts                                                        
tools/db/backfill-diary-team-links.ts                                                      
tools/db/backfill-keto-subject-set.ts                                                      
tools/db/backfill-personal-teams.ts                                                        
tools/db/backfill-team-relations-plural.ts                                                 
tools/db/cleanup-legacy-diary-tuples.ts                                                    
tools/docker-build.mjs                                                                     
tools/generators/split-tsconfigs/index.ts                                                  
tools/generators/split-tsconfigs/schema.d.ts                                               
tools/release/docker-preversion.mjs                                                        
tools/src/release/github-action-publisher.ts                                               
tools/src/release/go-module-publisher.cli.ts                                               
tools/src/tasks/seed-judge-fixture.ts                                                      
tools/src/verify-task-context.ts                                                           
�[93m�[4mUnused dependencies�[24m�[39m (49)
@earendil-works/gondolin                     apps/agent-daemon/package.json:38:6        
@opentelemetry/instrumentation               apps/agent-daemon/package.json:43:6        
@opentelemetry/instrumentation-dns           apps/agent-daemon/package.json:44:6        
@opentelemetry/instrumentation-http          apps/agent-daemon/package.json:45:6        
@opentelemetry/instrumentation-net           apps/agent-daemon/package.json:46:6        
@opentelemetry/instrumentation-pg            apps/agent-daemon/package.json:47:6        
@opentelemetry/instrumentation-pino          apps/agent-daemon/package.json:48:6        
@opentelemetry/instrumentation-undici        apps/agent-daemon/package.json:49:6        
pino-pretty                                  apps/agent-daemon/package.json:58:6        
@moltnet/models                              apps/console/package.json:11:6             
@moltnet/entry-explore-mcp-app               apps/mcp-server/package.json:30:6          
@themoltnet/design-system                    apps/mcp-server/package.json:34:6          
@fastify/otel                                apps/mcp-server/package.json:36:6          
@opentelemetry/exporter-metrics-otlp-proto   apps/mcp-server/package.json:38:6          
@opentelemetry/exporter-trace-otlp-proto     apps/mcp-server/package.json:39:6          
@opentelemetry/instrumentation               apps/mcp-server/package.json:40:6          
@opentelemetry/instrumentation-dns           apps/mcp-server/package.json:41:6          
@opentelemetry/instrumentation-http          apps/mcp-server/package.json:42:6          
@opentelemetry/instrumentation-net           apps/mcp-server/package.json:43:6          
@opentelemetry/instrumentation-pino          apps/mcp-server/package.json:44:6          
@opentelemetry/instrumentation-pg            apps/mcp-server/package.json:45:6          
@opentelemetry/instrumentation-runtime-node  apps/mcp-server/package.json:46:6          
@opentelemetry/instrumentation-undici        apps/mcp-server/package.json:47:6          
@opentelemetry/resources                     apps/mcp-server/package.json:48:6          
@opentelemetry/sdk-metrics                   apps/mcp-server/package.json:49:6          
@opentelemetry/sdk-trace-base                apps/mcp-server/package.json:50:6          
@opentelemetry/sdk-trace-node                apps/mcp-server/package.json:51:6          
@opentelemetry/semantic-conventions          apps/mcp-server/package.json:52:6          
pino                                         apps/mcp-server/package.json:56:6          
pino-opentelemetry-transport                 apps/mcp-server/package.json:57:6          
thread-stream                                apps/mcp-server/package.json:58:6          
@huggingface/transformers                    apps/rest-api/package.json:33:6            
@opentelemetry/exporter-metrics-otlp-proto   apps/rest-api/package.json:50:6            
@opentelemetry/instrumentation               apps/rest-api/package.json:52:6            
@opentelemetry/resources                     apps/rest-api/package.json:60:6            
@opentelemetry/sdk-metrics                   apps/rest-api/package.json:61:6            
@opentelemetry/sdk-trace-base                apps/rest-api/package.json:62:6            
@opentelemetry/sdk-trace-node                apps/rest-api/package.json:63:6            
@opentelemetry/semantic-conventions          apps/rest-api/package.json:64:6            
multiformats                                 apps/rest-api/package.json:71:6            
pino-pretty                                  apps/rest-api/package.json:74:6            
thread-stream                                apps/rest-api/package.json:75:6            
@noble/hashes                                libs/context-pack-service/package.json:19:6
typebox                                      libs/sdk/package.json:44:6                 
tslib                                        package.json:149:6                         
@moltnet/auth                                tools/package.json:38:6                    
@moltnet/models                              tools/package.json:45:6                    
drizzle-orm                                  tools/package.json:54:6                    
fastq                                        tools/package.json:55:6                    
�[93m�[4mUnused devDependencies�[24m�[39m (21)
@moltnet/database           apps/console/package.json:23:6              
@moltnet/bootstrap          apps/mcp-server/package.json:61:6           
@moltnet/database           apps/mcp-server/package.json:62:6           
drizzle-orm                 apps/mcp-server/package.json:65:6           
pino-pretty                 apps/mcp-server/package.json:66:6           
vitest                      libs/bootstrap/package.json:24:6            
@moltnet/crypto-service     libs/context-distill/package.json:17:6      
@moltnet/database           libs/context-distill/package.json:18:6      
@testcontainers/postgresql  libs/context-distill/package.json:19:6      
drizzle-orm                 libs/context-distill/package.json:20:6      
pg                          libs/context-distill/package.json:21:6      
@types/pg                   libs/context-distill/package.json:22:6      
testcontainers              libs/diary-service/package.json:29:6        
@testing-library/react      libs/entry-explore-mcp-app/package.json:30:6
vitest                      libs/mcp-test-harness/package.json:22:6     
@nx/devkit                  package.json:74:6                           
@swc/helpers                package.json:86:6                           
husky                       package.json:96:6                           
lint-staged                 package.json:101:6                          
vite-plugin-dts             package.json:109:6                          
@types/figlet               tools/package.json:64:6                     
�[93m�[4mReferenced optional peerDependencies�[24m�[39m (1)
ink  libs/design-system/package.json
�[93m�[4mUnlisted dependencies�[24m�[39m (2)
@moltnet/database  evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/governance.e2e.test.ts:19:46
pg                 libs/diary-service/__tests__/diary-service.dbos.integration.test.ts:38:27                
�[93m�[4mUnlisted binaries�[24m�[39m (7)
python3                                             .github/workflows/ci.yml     
clawhub                                             .github/workflows/release.yml
gofmt                                               .lintstagedrc.mjs            
go                                                  package.json                 
gofmt                                               package.json                 
packages/openclaw-skill/scripts/publish-clawhub.sh  package.json                 
packages/openclaw-skill/scripts/package.sh          package.json                 
�[93m�[4mUnused exports�[24m�[39m (113)
COMMON_REQUIRED_FLAGS                        apps/agent-daemon/src/lib/help.ts:3:14                           
COMMON_OPTIONAL_FLAGS                        apps/agent-daemon/src/lib/help.ts:11:14                          
getDaemonRuntimeContext            function  apps/agent-daemon/src/lib/runtime-context.ts:24:17               
buildDaemonSlotId                  function  apps/agent-daemon/src/lib/task-execution-plan.ts:97:17           
ENTRY_TYPE_LABELS                            apps/console/src/diaries/utils.ts:14:3                           
ENTRY_TYPES                                  apps/console/src/diaries/utils.ts:15:3                           
estimateTokenCount                           apps/console/src/diaries/utils.ts:16:3                           
formatDateTime                               apps/console/src/diaries/utils.ts:17:3                           
ENTRY_TYPE_OPTIONS                           apps/console/src/diaries/utils.ts:21:14                          
getEntryTypeQuery                  function  apps/console/src/diaries/utils.ts:29:17                          
MOBILE_BREAKPOINT                            apps/console/src/hooks/useIsMobile.ts:3:14                       
TABLET_BREAKPOINT                            apps/console/src/hooks/useIsMobile.ts:4:14                       
groupTasksByLane                             apps/console/src/tasks/status.ts:25:3                            
statusToLane                                 apps/console/src/tasks/status.ts:26:3                            
TASK_LANES                                   apps/console/src/tasks/status.ts:27:3                            
consoleCorrelationUrl              function  apps/issue-lifecycle/src/status-comment.ts:36:17                 
consoleAttemptUrl                  function  apps/issue-lifecycle/src/status-comment.ts:48:17                 
outputState                        function  apps/issue-lifecycle/src/test-fakes.ts:41:17                     
API_BASE_URL                                 apps/landing/src/api.ts:16:14                                    
handleDiaryTags                    function  apps/mcp-server/src/diary-tools.ts:315:23                        
handleGrantCreate                  function  apps/mcp-server/src/grant-tools.ts:38:23                         
handleGrantRevoke                  function  apps/mcp-server/src/grant-tools.ts:70:23                         
handleGrantList                    function  apps/mcp-server/src/grant-tools.ts:102:23                        
handlePacksUpdate                  function  apps/mcp-server/src/pack-tools.ts:319:23                         
handleRenderedPacksUpdate          function  apps/mcp-server/src/pack-tools.ts:409:23                         
handlePacksDiff                    function  apps/mcp-server/src/pack-tools.ts:511:23                         
EntryMapZoneSearchSchema                     apps/mcp-server/src/schemas/entry-explore-schemas.ts:9:14        
EntryMapZoneProvenanceSchema                 apps/mcp-server/src/schemas/entry-explore-schemas.ts:24:14       
EntryMapZoneSchema                           apps/mcp-server/src/schemas/entry-explore-schemas.ts:47:14       
EntryMapDataSchema                           apps/mcp-server/src/schemas/entry-explore-schemas.ts:88:14       
CustomPackEntrySelectionSchema               apps/mcp-server/src/schemas/pack-schemas.ts:107:14               
handleTasksContinue                function  apps/mcp-server/src/task-tools.ts:177:23                         
handleTeamsList                    function  apps/mcp-server/src/team-tools.ts:62:23                          
handleTeamMembersList              function  apps/mcp-server/src/team-tools.ts:84:23                          
handleTeamsCreate                  function  apps/mcp-server/src/team-tools.ts:109:23                         
handleTeamsJoin                    function  apps/mcp-server/src/team-tools.ts:132:23                         
handleTeamsDelete                  function  apps/mcp-server/src/team-tools.ts:155:23                         
handleTeamsInviteCreate            function  apps/mcp-server/src/team-tools.ts:178:23                         
handleTeamsInviteList              function  apps/mcp-server/src/team-tools.ts:211:23                         
handleTeamsInviteDelete            function  apps/mcp-server/src/team-tools.ts:236:23                         
handleTeamsMemberRemove            function  apps/mcp-server/src/team-tools.ts:264:23                         
ServerConfigSchema                           apps/rest-api/src/config.ts:27:14                                
DatabaseConfigSchema                         apps/rest-api/src/config.ts:39:14                                
WebhookConfigSchema                          apps/rest-api/src/config.ts:44:14                                
RecoveryConfigSchema                         apps/rest-api/src/config.ts:48:14                                
OryConfigSchema                              apps/rest-api/src/config.ts:52:14                                
ObservabilityConfigSchema                    apps/rest-api/src/config.ts:63:14                                
RuntimeSessionStorageConfigSchema            apps/rest-api/src/config.ts:127:14                               
TaskArtifactStorageConfigSchema              apps/rest-api/src/config.ts:145:14                               
EmbeddingConfigSchema                        apps/rest-api/src/config.ts:161:14                               
SecurityConfigSchema                         apps/rest-api/src/config.ts:168:14                               
loadEmbeddingConfig                function  apps/rest-api/src/config.ts:376:17                               
loadPackGcConfig                   function  apps/rest-api/src/config.ts:386:17                               
loadTaskOrphanSweeperConfig        function  apps/rest-api/src/config.ts:396:17                               
loadTaskArtifactStorageConfig      function  apps/rest-api/src/config.ts:416:17                               
acceptsProblemJson                           apps/rest-api/src/problems/index.ts:2:3                          
findProblemTypeByCode                        apps/rest-api/src/problems/index.ts:9:3                          
findProblemTypeByStatus                      apps/rest-api/src/problems/index.ts:10:3                         
getTypeUri                                   apps/rest-api/src/problems/index.ts:11:3                         
problemTypes                                 apps/rest-api/src/problems/index.ts:13:3                         
DiaryTagCountSchema                          apps/rest-api/src/schemas/diary.ts:58:14                         
PublicAuthorSchema                           apps/rest-api/src/schemas/diary.ts:123:14                        
ContextPackEntrySchema                       apps/rest-api/src/schemas/packs.ts:9:14                          
TaskTypeDescriptorSchema                     apps/rest-api/src/schemas/tasks.ts:305:14                        
serializeRuntimeWorkspace          function  apps/rest-api/src/services/runtime-slots.ts:171:17               
inflateRowCreator                  function  apps/rest-api/src/utils/auth-principal.ts:142:23                 
resolvePrincipal                             apps/rest-api/src/utils/auth-principal.ts:191:10                 
HumanOnboardingError               class     apps/rest-api/src/workflows/human-onboarding-workflow.ts:36:14   
diaryTransferWorkflow                        apps/rest-api/src/workflows/index.ts:4:3                         
TRANSFER_DECISION_EVENT                      apps/rest-api/src/workflows/index.ts:7:3                         
HumanOnboardingError                         apps/rest-api/src/workflows/index.ts:12:3                        
DEFAULT_WORKFLOW_TIMEOUT_MS                  apps/rest-api/src/workflows/index.ts:46:3                        
runWorkflow                                  apps/rest-api/src/workflows/index.ts:47:3                        
FOUNDING_ACCEPT_EVENT                        apps/rest-api/src/workflows/index.ts:51:3                        
TeamFoundingTimeoutError                     apps/rest-api/src/workflows/index.ts:57:3                        
teamFoundingWorkflow                         apps/rest-api/src/workflows/index.ts:58:3                        
DEFAULT_WORKFLOW_TIMEOUT_MS                  apps/rest-api/src/workflows/run-workflow.ts:14:14                
runWorkflow                        function  apps/rest-api/src/workflows/run-workflow.ts:33:23                
TeamFoundingTimeoutError           class     apps/rest-api/src/workflows/team-founding-workflow.ts:32:14      
DEFAULT_E2E_REST_API_URL                     libs/bootstrap/src/e2e-harness.ts:26:14                          
DEFAULT_E2E_DATABASE_URL                     libs/bootstrap/src/e2e-harness.ts:27:14                          
DEFAULT_E2E_HYDRA_PUBLIC_URL                 libs/bootstrap/src/e2e-harness.ts:29:14                          
DEFAULT_E2E_HYDRA_ADMIN_URL                  libs/bootstrap/src/e2e-harness.ts:30:14                          
DEFAULT_E2E_KETO_READ_URL                    libs/bootstrap/src/e2e-harness.ts:31:14                          
DEFAULT_E2E_KETO_WRITE_URL                   libs/bootstrap/src/e2e-harness.ts:32:14                          
DEFAULT_E2E_KRATOS_ADMIN_URL                 libs/bootstrap/src/e2e-harness.ts:33:14                          
DEFAULT_E2E_AGENT_SCOPES                     libs/bootstrap/src/e2e-harness.ts:34:14                          
DBOSWorkflowConflictError                    libs/database/src/dbos.ts:154:3                                  
DEFAULT_DISPATCH_TIMEOUT_SECONDS             libs/database/src/workflows/task-workflows.ts:135:14             
DEFAULT_RUNNING_TIMEOUT_SECONDS              libs/database/src/workflows/task-workflows.ts:139:14             
MAX_PUBLIC_CONTENT_LENGTH                    libs/diary-service/src/diary-service.ts:51:14                    
nextStepId                         function  libs/entry-explore-mcp-app/src/state/map.ts:117:17               
DEFAULT_TASK_ARTIFACT_MAX_BYTES              libs/node-red-contrib-core/src/nodes/task-artifact-utils.ts:9:14 
resolveTaskId                      function  libs/node-red-contrib-core/src/nodes/task-artifact-utils.ts:26:17
resolveTeamId                      function  libs/node-red-contrib-core/src/nodes/task-artifact-utils.ts:39:17
resolveAttemptN                    function  libs/node-red-contrib-core/src/nodes/task-artifact-utils.ts:53:17
resolveOverride                    function  libs/node-red-contrib-core/src/nodes/task-builder.ts:105:17      
abortError                         function  libs/pi-extension/src/abort-utils.ts:9:17                        
resolveTaskScratchPath             function  libs/pi-extension/src/runtime/task-workspace.ts:130:17           
GUEST_TASK_SKILLS_MOUNT                      libs/pi-extension/src/vm-manager.ts:42:14                        
makeClient                         function  packages/legreffier-cli/src/api.ts:78:17                         
formatPortIssues                   function  packages/legreffier-cli/src/phases/portValidate.ts:213:17        
main                               function  tools/src/release/go-artifact-publisher.cli.ts:106:23            
printGoArtifactReleasePlan         function  tools/src/release/go-artifact-publisher.ts:531:17                
readText                           function  tools/src/release/go-version-actions.ts:43:17                    
readGoModulePath                   function  tools/src/release/go-version-actions.ts:47:17                    
resolveGoReleaseValidationRoots    function  tools/src/release/go-version-actions.ts:200:17                   
default                            class     tools/src/release/go-version-actions.ts:731:22                   
gitMergeBase                       function  tools/src/tasksmith/gh-client.ts:151:23                          
gitShowFileAtRef                   function  tools/src/tasksmith/gh-client.ts:206:23                          
SEED_INSTRUCTION                             tools/src/tasksmith/task-extractor.ts:568:10                     
verifyTask                         function  tools/src/tasksmith/verify.ts:356:23                             
cleanupPrArtifacts                 function  tools/src/tasksmith/verify.ts:480:23                             
�[93m�[4mUnused exported types�[24m�[39m (65)
PiAgentDirSource                type       apps/agent-daemon/src/lib/pi-agent-dir.ts:4:13                    
MailRecord                      interface  apps/console/e2e/helpers/mailslurper.ts:3:18                      
GroupedTasks                    type       apps/console/src/tasks/status.ts:24:8                             
TaskLane                        type       apps/console/src/tasks/status.ts:28:8                             
TaskLaneId                      type       apps/console/src/tasks/status.ts:29:8                             
UiResourceData                  interface  apps/mcp-host/src/implementation.ts:25:18                         
EntryMapZoneSearch              type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:22:13        
EntryMapZone                    type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:86:13        
CorsPluginOptions               interface  apps/rest-api/src/plugins/cors.ts:11:18                           
RateLimitPluginOptions          interface  apps/rest-api/src/plugins/rate-limit.ts:19:18                     
ProblemType                     type       apps/rest-api/src/problems/index.ts:12:8                          
AgentPrincipal                  type       apps/rest-api/src/schemas/principal.ts:37:8                       
HumanPrincipal                  type       apps/rest-api/src/schemas/principal.ts:39:8                       
PrincipalIdentity               type       apps/rest-api/src/schemas/principal.ts:41:8                       
RuntimeSlotSubject              interface  apps/rest-api/src/services/runtime-slots.ts:33:18                 
CreateTaskInput                 type       apps/rest-api/src/services/task.service.ts:2:8                    
AuthContext                     type       apps/rest-api/src/types.ts:14:3                                   
RelationshipReader              type       apps/rest-api/src/types.ts:16:3                                   
RelationshipWriter              type       apps/rest-api/src/types.ts:17:3                                   
RuntimeSessionStorage           type       apps/rest-api/src/types.ts:45:15                                  
TaskArtifactStorage             type       apps/rest-api/src/types.ts:46:15                                  
DiaryTransferDeps               type       apps/rest-api/src/workflows/index.ts:2:8                          
DiaryTransferResult             type       apps/rest-api/src/workflows/index.ts:3:8                          
TransferDecision                type       apps/rest-api/src/workflows/index.ts:8:8                          
HumanOnboardingDeps             type       apps/rest-api/src/workflows/index.ts:11:8                         
HumanOnboardingResult           type       apps/rest-api/src/workflows/index.ts:13:8                         
LegreffierOnboardingDeps        type       apps/rest-api/src/workflows/index.ts:24:8                         
MaintenanceDeps                 type       apps/rest-api/src/workflows/index.ts:33:8                         
RegistrationDeps                type       apps/rest-api/src/workflows/index.ts:38:8                         
RegistrationResult              type       apps/rest-api/src/workflows/index.ts:39:8                         
RunWorkflowOptions              type       apps/rest-api/src/workflows/index.ts:48:8                         
FoundingMember                  type       apps/rest-api/src/workflows/index.ts:52:8                         
TeamFoundingDeps                type       apps/rest-api/src/workflows/index.ts:55:8                         
TeamFoundingResult              type       apps/rest-api/src/workflows/index.ts:56:8                         
RunWorkflowOptions              interface  apps/rest-api/src/workflows/run-workflow.ts:21:18                 
AdoptionState                   interface  docs/.vitepress/theme/auth/useAdoption.ts:38:18                   
AdoptionStageKey                type       docs/.vitepress/theme/auth/useAdoption.ts:285:13                  
AdoptionStage                   interface  docs/.vitepress/theme/auth/useAdoption.ts:293:18                  
DocsTeam                        interface  docs/.vitepress/theme/auth/useTeamSelection.ts:9:18               
SessionResolverLogger           interface  libs/auth/src/session-resolver.ts:24:18                           
GroupCreator                    interface  libs/database/src/repositories/group.repository.ts:16:18          
RuntimeWorkspaceKind            type       libs/database/src/repositories/runtime-slot.repository.ts:15:13   
EntriesListArgs                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:22:18        
EntriesSearchArgs               interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:32:18        
DiaryTagsArgs                   interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:44:18        
EntriesGetArgs                  interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:51:18        
PacksCreateArgs                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:57:18        
PacksUpdateArgs                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:65:18        
PacksProvenanceArgs             interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:71:18        
CommandRegistrar                type       libs/pi-extension/src/commands/index.ts:5:3                       
SessionMeta                     type       libs/pi-extension/src/commands/index.ts:7:3                       
SubmitMissingRepromptEvent      interface  libs/pi-extension/src/runtime/execute-pi-task.ts:1813:18          
RateLimitRetryOptions           type       libs/sdk/src/retry.ts:5:15                                        
TaskArtifactAttemptInput        interface  libs/task-artifact-service/src/task-artifacts.ts:62:18            
SuccessCriteriaRubricCriterion  interface  libs/task-ui/src/success-criteria.ts:80:18                        
RubricTemplate                  interface  libs/task-ui/src/success-criteria.ts:123:18                       
AgentAdapter                    type       packages/legreffier-cli/src/adapters/index.ts:13:15               
AgentAdapterOptions             type       packages/legreffier-cli/src/adapters/index.ts:13:29               
ResolveInstallationStatus       type       packages/legreffier-cli/src/phases/portResolveInstallation.ts:6:13
VerifyInstallationStatus        type       packages/legreffier-cli/src/phases/portVerifyInstallation.ts:4:13 
InitPhase                       type       packages/legreffier-cli/src/state.ts:4:13                         
GoArtifactBuildStep             type       tools/src/release/go-artifact-publisher.ts:74:13                  
EvalMode                        type       tools/src/tasks/scenario.ts:31:13                                 
EvalWorkspace                   type       tools/src/tasks/scenario.ts:32:13                                 
ScenarioCriterion               interface  tools/src/tasks/scenario.ts:34:18                                 
�[93m�[4mDuplicate exports�[24m�[39m (1)
GUEST_TASK_CONTEXT_MOUNT|GUEST_TASK_SKILLS_MOUNT  libs/pi-extension/src/vm-manager.ts
�[93m�[4mUnused catalog entries�[24m�[39m (4)
@anthropic-ai/claude-agent-sdk  default  pnpm-workspace.yaml:25:4 
@fastify/static                 default  pnpm-workspace.yaml:37:4 
@openai/codex-sdk               default  pnpm-workspace.yaml:62:4 
zod                             default  pnpm-workspace.yaml:153:3
�[33m�[4mConfiguration hints�[24m (4)�[39m
. �[90m(root)�[39m         knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["."]�[90m (16 unused files)�[39m           
tools            knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["tools"]�[90m (14 unused files)�[39m       
apps/rest-api    knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/rest-api"]�[90m (4 unused files)�[39m
apps/mcp-host    knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/mcp-host"]�[90m (2 unused files)�[39m
 ELIFECYCLE  Command failed with exit code 1.

Self-review follow-up to the in-session submit-missing fix.

pi-extension:
- Stop re-prompting on a persisted provider error. A spent or
  non-retryable provider error leaves `llmAbort` set even though
  `promptWithProviderErrorRetries` returns `runError: null`; the loop's
  `isStopped` only checked cancel/cap, so it nudged a dead provider up to
  3 more times. Extract `submitRepromptStopped` (cancel | cap | llmAbort)
  and gate on it.
- Extract `resolveSubmitMissingConfig` (pure) so the default-budget /
  disable-when-no-tool / gate-mapping wiring — previously only reachable
  through a booted VM — is unit-tested. An inverted ternary now fails a
  test. Drops the unreachable `'Go on'` fallback to `''`.
- Record `output_missing` on the never-called submit path (dimensioned by
  model) and emit a `submit_missing_summary` event with the reprompt
  count, so submit-missing failures and nudge frequency are visible to the
  parse-result counter / log stream.

agent-daemon:
- Bind taskId / attemptN / correlationId onto `attempt-failure-classified`
  so a verdict can be pivoted back to the abandoned task (the daemon log
  child carries only agent/team/profile).
- Redact the model-authored `reason` through `redactRetryTriageSecrets`
  before logging — parity with the already-sanitized `triage_failed`
  path; the prior log shipped it raw to a wide-access sink.

Tests: submitRepromptStopped, resolveSubmitMissingConfig, the
classification log identifiers + redaction + decision/confidence-omitted
branch, and full-path classifyAttemptFailure non-retryability for
submit_output_missing.

Refs #1528
@getlarge getlarge merged commit 6299d92 into main Jun 30, 2026
25 checks passed
@getlarge getlarge deleted the issue-1528-submit-missing-reprompt branch June 30, 2026 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant