[genesiscz]

Part 3 of 5 of the split of the unified branch #507 (cut at 189a4569d). Each split PR holds whole commits from unified, picked in their original order; commits already in another open PR (#524, #527, #528, #530, #531, #532) stay there.

Base

Stacked on #533 (feat/2026-10-15-cmux-find-links-and-hub-commit-links) as a precaution: both change src/question/lib/decisions/read.ts. Merge after it.

Commits (11)

• 201a50a fix(ts, sourcemaps): a command that built removes its build worktree when it ends, even on failure or Ctrl-C, and cache prune --all removes one unused for an hour, so installed dependencies stop piling up in ~/.genesis-tools
• 15eada4 fix(ax-tool): the recording border frames the recorded windows, also on a display canvas, so it no longer reads as "the whole screen is recorded"
• 8efcee3 fix(tools): ./tools never runs bun install by itself in a linked worktree, it prints the repair command, because a fresh install's native binaries stall at macOS's first-run check
• bb692e6 fix(github): the merge restack borrows the local object store, so its fetch takes 8 s instead of timing out at 300 s, and passes the token through git's environment instead of its argv
• 80def1f fix(doctor): the security check warns when the terminal app that runs builds is not on the Developer Tools list
• f12598c perf(doctor): the Developer Tools check walks its ancestors through the process layer instead of one ps per level, which no-process-tool-spawn refused
• 79da11d refactor(tools): every .genesis-tools path is built by storage/root (genesisToolsDir, or genesisToolsDirIn for a sandbox home), and lint-rules fails a hand-joined one, because 109 call sites each decided the root themselves
• 8e77c30 docs(debugging-master): put back the llm-log usage lines 985e6b5 dropped, because timerStart, snapshot, the stack opt-outs and opts still exist
• 1d20e9c fix(utils): export @genesiscz/utils/storage/root, because the youtube dashboard bundle imports it since the .genesis-tools path sweep
• d8705f5 feat(ax-tool, control): act --action drag --allow-outside drags a window by its body or past its edge in the background, locating each step against the window's current frame, because a drag that moved its own window was refused and the posture message could only be tested by taking the user's pointer
• 2c9029b fix(ax-tool): the act parser accepts --allow-outside for a drag, because its per-command flag list refused the new flag as unknown before anything ran

118 files changed, 1488 insertions(+), 597 deletions(-).

4b0b83f leaves four files at master's version (lint-rules.ts, lint-rules.test.ts, retire-native-cache.ts, scanner.ts): master allows the hand-joined path there on purpose.

Review

Review rounds run with GPT-6.1 Sol: one worker fixes the bot threads, a second one reviews the code independently, and Claude judges each round before its push.

Summary by CodeRabbit

• New Features
  • Drag actions can continue beyond a window’s visible bounds and follow it if it moves. Results include the window’s final bounds.
  • Source-map cache tools can list and prune projects, report space reclaimed, and clean up eligible managed build worktrees. Builds can retain a worktree when requested.
• Bug Fixes
  • Recording indicators now stay positioned around the selected window, including in display-canvas recordings.
  • Git authentication tokens are kept out of clone command arguments and repository configuration.
• Documentation
  • Updated guidance for linked worktrees, drag actions, and source-map cache cleanup.

[eve-bot-lovinka]

🐉 eve review — 💬 COMMENT · 0 findings

→ review · run

• Queued 05:17:30Z
• Reading diff — 222 files
• Building repo map
• Analyzing (find → verify) — 0 candidates → 0 survivors · reviewed by codex/gpt-6.1-sol
• Posting review
• Review posted 05:26:51Z (9m 21s)

_{run wrun_01M544PHDA1P8HW5WRDPABXJAJ}

Previous runs (10)

run	head	outcome	findings	took
15	b992e7a	🔁 deduped (run wrun_01M owns it)	—	—
14	30492ad	⏭️ superseded	—	4m 4s
13	142ab9a	✅ APPROVE	2	8m 53s
12	537b120	💬 COMMENT	1	11m 37s
12	537b120	🔁 deduped (run wrun_01M owns it)	—	—
11	9c97de1	⏭️ superseded	—	7m 33s
10	891a1f8	💬 COMMENT	2	13m 38s
9	7a3db22	💬 COMMENT	0	18m 10s
8	6ffb11c	💬 COMMENT	2	11m 47s
7	4d6ce42	💬 COMMENT	1	12m 16s

[coderabbitai]

Warning

Review limit reached

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 68 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: c89e4449-4b5c-4516-a5d0-f83410328a2c

📥 Commits

Reviewing files that changed from the base of the PR and between 142ab9a and b992e7a.

📒 Files selected for processing: 135

• .claude/rules/tools.md
• CLAUDE.md
• native/ax-tool/SnapshotSupport/WindowEvents.swift
• native/ax-tool/SnapshotSupport/WorkflowArguments.swift
• native/ax-tool/Sources/IsolatedCapture.swift
• native/ax-tool/Sources/SnapshotWorkflow.swift
• native/ax-tool/Tests/WindowEventTests.swift
• native/ax-tool/Tests/WorkflowArgumentsTests.swift
• scripts/ai-proxy/structured-output.ts
• scripts/backfill-product-units.ts
• scripts/benchmarks/agent-sessions/session-listing.ts
• scripts/benchmarks/ai-usage/poll-duty.ts
• scripts/benchmarks/compress/arms.ts
• scripts/benchmarks/compress/read-paths.ts
• scripts/benchmarks/dashboards/idle-cost.ts
• scripts/benchmarks/hooks/attribution.ts
• scripts/benchmarks/hooks/hook-latency.ts
• scripts/benchmarks/hooks/status-ab.ts
• scripts/benchmarks/polls/agents-bridge-register.ts
• scripts/benchmarks/polls/agents-request-wait.ts
• scripts/ci/harvest-placeholder-markers.ts
• scripts/ci/lint-rules.test.ts
• scripts/ci/lint-rules.ts
• scripts/history/benchmark.ts
• scripts/history/retire-native-cache.ts
• scripts/session-changes-compare.ts
• scripts/tools-entrypoint.test.ts
• src/Internal/commands/reas/cache/index.ts
• src/Internal/commands/reas/lib/store.ts
• src/agents/lib/changes/log.ts
• src/agents/lib/changes/objects.ts
• src/agents/lib/hooks/diff/writers.ts
• src/ai-proxy/scripts/verify-openrouter-live.ts
• src/ask/AIChat.ts
• src/ask/chat/ConversationManager.ts
• src/ask/lib/db.ts
• src/automate/lib/credentials.ts
• src/automate/lib/daemon.ts
• src/automate/lib/db.ts
• src/automate/lib/launchd.ts
• src/benchmark/lib/results.ts
• src/cmux/lib/capture-installer.ts
• src/cmux/lib/capture-journal.ts
• src/cmux/lib/capture-runtime-logger.ts
• src/cmux/lib/screen-cache.ts
• src/control/README.md
• src/control/commands/workflow.test.ts
• src/control/commands/workflow.ts
• src/control/lib/computer-use/schemas.ts
• src/control/lib/computer-use/session.test.ts
• src/control/lib/computer-use/session.ts
• src/control/lib/runner.ts
• src/control/mcp/server.ts
• src/daemon/lib/config.ts
• src/daemon/lib/launchd.ts
• src/debugging-master/core/file-tailer.test.ts
• src/debugging-master/core/paths.ts
• src/dev-dashboard/lib/e2e/box.ts
• src/dev-dashboard/lib/e2e/pairing-code.ts
• src/dev-dashboard/lib/system/history-db.ts
• src/dev-dashboard/lib/tunnel/pairing.ts
• src/dev-dashboard/server/routes/e2e.ts
• src/doctor/__tests__/developer-tools.test.ts
• src/doctor/analyzers/app-bloat.ts
• src/doctor/analyzers/security.ts
• src/doctor/lib/paths.ts
• src/github/lib/cache.ts
• src/github/lib/stack-restack.test.ts
• src/github/lib/stack-restack.ts
• src/handoff/log-store.ts
• src/handoff/read-model.ts
• src/indexer/lib/sources/telegram-source.ts
• src/jev/lib/route/cache.ts
• src/jev/lib/sessions.ts
• src/jev/lib/wake/wake.ts
• src/learn-from-fable/commands/report.ts
• src/learn-from-fable/lib/config.ts
• src/macos/GenesisTools/scripts/perf-report.ts
• src/macos/lib/clones/file-meta-cache.ts
• src/macos/lib/swap/scanner.ts
• src/mcp-manager/lib/gateway/login-runner.ts
• src/mcp-manager/lib/gateway/service.ts
• src/monitor/lib/db.ts
• src/node-repl/lib/trust.ts
• src/question/lib/config.ts
• src/question/lib/decisions/read.ts
• src/question/lib/log-store.ts
• src/question/lib/pending/events.ts
• src/question/lib/pending/store.ts
• src/question/lib/transclude.ts
• src/scripts/lib/store.ts
• src/shops/db/ShopsDatabase.ts
• src/shops/lib/crypto.ts
• src/stash/lib/storage.ts
• src/task/lib/test-harness.ts
• src/task/tests/task-integration-env.ts
• src/telegram/lib/AssistantEngine.ts
• src/telegram/lib/AttachmentDownloader.ts
• src/telegram/lib/TelegramHistoryStore.ts
• src/telegram/lib/actions/ask.ts
• src/todo/lib/store.ts
• src/ts/README.md
• src/ts/commands/cli.test.ts
• src/ts/commands/sourcemaps.ts
• src/utils/DashboardApp/pidFile.ts
• src/utils/agent-sessions/database.ts
• src/utils/agent-sessions/testing/baseline-oracle.ts
• src/utils/agent-sessions/testing/fixture-world.ts
• src/utils/ai/local/runtimes/sherpa/paths.ts
• src/utils/ai/openai/native-session-import.ts
• src/utils/ai/proxy/AiProxyClient.ts
• src/utils/ai/transcripts/turn-index.ts
• src/utils/claude/keychain.ts
• src/utils/claude/subscription-auth.ts
• src/utils/claude/worker-paths.ts
• src/utils/cli/bun-link.ts
• src/utils/cli/worktree-install.ts
• src/utils/codex/worker-paths.ts
• src/utils/debugging-master/llm-log.ts
• src/utils/docker/qdrant.ts
• src/utils/grok/worker-paths.ts
• src/utils/macos/genesis-app.ts
• src/utils/obsidian/config.ts
• src/utils/package.json
• src/utils/profile/profile.ts
• src/utils/services/ensure.ts
• src/utils/storage/root.ts
• src/utils/ts/sourcemaps/build.ts
• src/utils/ts/sourcemaps/cache.ts
• src/utils/ts/sourcemaps/sourcemaps.test.ts
• src/youtube/lib/cache.ts
• src/youtube/lib/config.ts
• src/youtube/lib/db.ts
• src/youtube/lib/server/port-file.ts
• tools

📝 Walkthrough

The pull request adds outside-window drag support, managed source-map build-worktree cleanup and pruning, and shared helpers for Genesis Tools storage paths. It also adds a Developer Tools permission finding, changes Git restack authentication, and adjusts automatic installation behavior in linked worktrees.

Changes: Window drag behavior

Layer / File(s)	Summary
Expose and validate outside-window drags src/control/commands/workflow.ts, src/control/lib/computer-use/*, native/ax-tool/SnapshotSupport/WorkflowArguments.swift	The interfaces add allow_outside or --allow-outside. The native validator accepts the flag only for drag actions.
Parse drag points and track live bounds native/ax-tool/SnapshotSupport/WindowEvents.swift, native/ax-tool/Sources/SnapshotWorkflow.swift	When enabled, drag destinations can leave the snapshot window. Later checks verify that the window remains on screen, and the result includes current bounds when available. Drag and release event coordinates can use live window bounds.
Test drag events and capture framing native/ax-tool/Tests/*, src/control/lib/computer-use/session.test.ts, src/control/README.md, src/control/mcp/server.ts, native/ax-tool/Sources/IsolatedCapture.swift	Tests cover moving windows, release events, and outside-point validation. Documentation describes the flag, and the recording indicator tracks selected window bounds.

Source-map build worktrees

Layer / File(s)	Summary
Track, cancel, and remove managed worktrees src/utils/ts/sourcemaps/build.ts	Builds track active processes and managed worktrees. New APIs stop builds, wait for them to release locks, and remove eligible worktrees.
Report cache and worktree pruning src/utils/ts/sourcemaps/cache.ts	Pruning returns structured removal and retention details, including byte counts. It also checks whether an idle managed worktree can be removed.
Wire cleanup and cache commands src/ts/commands/sourcemaps.ts, src/ts/README.md	CLI actions release managed worktrees and handle interruption. Cache commands support project listing and pruning one or all projects. Documentation describes cleanup behavior and retention conditions.
Test worktree removal and interruption src/utils/ts/sourcemaps/sourcemaps.test.ts, src/ts/commands/cli.test.ts	Tests cover worktree retention and removal, build cancellation, cleanup, and Ctrl-C handling.

Genesis Tools storage paths

Layer / File(s)	Summary
Define and enforce storage-path helpers src/utils/storage/root.ts, src/utils/package.json, scripts/ci/lint-rules.ts, scripts/ci/lint-rules.test.ts, .claude/rules/tools.md	The storage module exports genesisToolsDirIn and the package export. The lint rule detects manually joined .genesis-tools paths across home expressions. The repository rule documents the helper and prohibition.
Resolve standard paths through shared helpers src/**, scripts/*	Application modules and scripts use genesisToolsDir or toolDataDir for standard storage paths instead of assembling .genesis-tools paths directly.
Resolve sandbox and fixture paths scripts/benchmarks/*, scripts/ci/harvest-placeholder-markers.ts, src/task/*, src/utils/agent-sessions/testing/*, src/utils/ai/openai/native-session-import.ts, src/agents/lib/hooks/diff/writers.ts, src/cmux/lib/capture-installer.ts, src/doctor/analyzers/app-bloat.ts	Explicit-home paths in benchmarks, fixtures, and other workflows now use genesisToolsDirIn.

Developer Tools security finding

Layer / File(s)	Summary
Resolve host app and evaluate TCC grants src/doctor/analyzers/security.ts, src/doctor/__tests__/developer-tools.test.ts	The analyzer identifies the host app and reads Developer Tools grants from system and user TCC databases. It emits a finding when the status is known; tests cover grant matching, incomplete reads, app identification, and rescanning.

Git restack behavior

Layer / File(s)	Summary
Configure Git authentication and object-store reuse src/github/lib/stack-restack.ts, src/github/lib/stack-restack.test.ts	Git authentication uses an environment extraheader instead of a token in the clone URL. The temporary repository can use the current checkout’s object store as an alternate.

Linked-worktree installation behavior

Layer / File(s)	Summary
Gate automatic installation in linked worktrees tools, src/utils/cli/worktree-install.ts, scripts/tools-entrypoint.test.ts, CLAUDE.md	The reinstall guard skips automatic installation in a linked worktree unless TOOLS_AUTOINSTALL=1. Instructions state that the user must run bun install otherwise.

Priority: ➖ Normal

Estimated code review effort: 5 (Critical) | ~120 minutes

Change: Refactor

Sequence Diagram(s)

sequenceDiagram
  participant ComputerUseSession
  participant WorkflowCLI
  participant NativeAct
  participant WindowEventFactory
  ComputerUseSession->>WorkflowCLI: pass allow_outside for drag
  WorkflowCLI->>NativeAct: forward --allow-outside
  NativeAct->>WindowEventFactory: create drag events with live bounds

Loading

sequenceDiagram
  participant SourcemapsCommand
  participant BuildAtCommit
  participant SourcemapCache
  participant GitWorktree
  SourcemapsCommand->>BuildAtCommit: start build in managed worktree
  BuildAtCommit->>GitWorktree: prepare worktree and run build
  SourcemapsCommand->>BuildAtCommit: release or stop tracked builds
  SourcemapsCommand->>SourcemapCache: prune cache and idle worktree
  SourcemapCache->>GitWorktree: check and remove eligible worktree

Loading

Merge Risk: 🔵 Low · up to 142ab

Two narrow issues remain: the suggested install command may fail for some workspace paths, and an outside drag may return without final window geometry if refresh fails. Both have localized fixes; the PR is mergeable with owner awareness.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 41.82% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 110 functions across 63 files. (2 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the primary change: centralizing all .genesis-tools paths through one storage root helper. It also accurately notes the related tool, doctor, GitHub, and ax-tool fixes.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 41.82% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 110 functions across 63 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[genesiscz]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 22 minutes.

[eve-bot-lovinka]

🐉 eve review — 🟡 Review comments

2c9029b · 4 actionable findings · ⚠️ degraded pass · reviewed by codex/gpt-6.1-sol · view run ↗

Severity	Count
🟡 Medium	3
🔵 Low	1

⚠️ Degraded pass — this review did not run at full strength; treat the verdict as partial.

• typecheck timed out (tsconfig.json): out of memory, then its 6144 MiB retry ran out of time

Blast radius

• mouse (~) → 5 dependent(s) outside this PR: src/macos/GenesisKit/Tests/GenesisKitTests/InstantTooltipTests.swift, src/macos/GenesisKit/Tests/GenesisKitTests/Markdown/MarkdownDocumentWindowTests.swift, src/macos/GenesisKit/Tests/GenesisKitTests/Markdown/MarkdownSplitViewTests.swift, +2 more
• sessionChangesPath (~) → 5 dependent(s) outside this PR: src/agents/commands/changes.ts, src/agents/lib/hooks/diff/run.ts, src/agents/lib/changes/log.test.ts, +2 more
• ComputerUse (~) → 4 dependent(s) outside this PR: src/control/lib/capture-native.ts, src/control/lib/computer-use/session.test.ts, src/control/scripts/task-benchmark.ts, +1 more
• drag (+) → 4 dependent(s) outside this PR: src/macos/GenesisKit/Tests/GenesisKitTests/Markdown/MarkdownDocumentWindowTests.swift, src/macos/GenesisKit/Tests/GenesisKitTests/Markdown/MarkdownPathsTests.swift, src/macos/GenesisKit/Tests/GenesisKitTests/Markdown/MarkdownPageExtrasWebTests.swift, +1 more
• objectsDir (~) → 3 dependent(s) outside this PR: src/agents/commands/changes.ts, src/agents/lib/changes/tool-changes.ts, src/agents/lib/changes/diff.ts
• createBaselineBenchmarkVariant (~) → 2 dependent(s) outside this PR: scripts/history/benchmark.test.ts, scripts/history/compact-candidate.test.ts
• installLaunchd (~) → 2 dependent(s) outside this PR: src/daemon/commands/install.ts, src/daemon/interactive/menu.ts
• computerSchemas (~) → 1 dependent(s) outside this PR: src/control/lib/computer-use/session.test.ts
• ComputerUse.drag (~) → 1 dependent(s) outside this PR: src/control/scripts/live-smoke.ts
• +3 more changed symbol(s) with outside dependents
• 1 compiler diagnostic(s) on the PR head touch this diff (graph truncated)

ℹ️ Claims vs diff — 8 claims could not be checked from the diff (c1, c2, c3, c4, c5, c6, c7, c8).

[genesiscz]

Review fixes 2026-10-16 20:35 from GPT-6.1 Sol judged by Claude Opus 5.5

Round 1, including late eve threads. 4 open threads (eve 4, CodeRabbit 0, humans 0), plus 2 independent lead findings. Across 6 items: 3 fixed, 0 rejected, 2 already done, 1 no-change because its implementation is outside this PR's scope. Lead verified 884b862 with 129 passing tests and both old-code plants failing. Followup security tests pass; full typecheck retains three out-of-scope hub errors.

allow_outside was rejected before reaching native drag (lead, no thread)

• Context: The independent-review (GPT-6.1 Sol) finding, confirmed by the lead, showed that point() rejected an outside destination before --allow-outside could reach the bridge.
• Commit(s): 884b86223
• Verdict: accepted
• Code before:

  this.point({
      record,
      x: options.to_x,
      y: options.to_y,
      coordinateSpace: options.coordinate_space,
  })

• Code after:

  this.point({
      record,
      x: options.to_x,
      y: options.to_y,
      coordinateSpace: options.coordinate_space,
      allowOutside: options.allow_outside,
  })

• How was this fixed: Only the destination can bypass window containment. Existing finite-number schema checks, screenshot bounds and start-point containment remain active. The existing session.test.ts fake bridge regression verifies refusal without the flag, refusal of an outside start, refusal of invalid image/non-finite coordinates, and exactly one successful native call with the flag. The full control suite passed: 57 tests, exit 0.
• Confidence: 98%

Stopping a compound build left its child running (lead, no thread)

• Context: The independent-review (GPT-6.1 Sol) finding, confirmed by the lead, showed that killing sh -c alone left a separate build child holding stdout/stderr open, delaying worktree release indefinitely.
• Commit(s): 884b86223
• Verdict: accepted
• Code before:

  for (const proc of held.processes) {
      proc.kill();
  }

• Code after:

  await Promise.all([...held.processes].map(stopBuild));
  // stopBuild signals the detached process group:
  signalGroup("SIGTERM");
  await Bun.sleep(250);
  signalGroup("SIGKILL");

• How was this fixed: Build shells start detached in their own process group. Both stopping release and AbortSignal cancellation terminate the group with SIGTERM, allow 250 ms grace, then SIGKILL surviving children. The existing cancellation test now uses a compound command with a separate child that ignores SIGTERM and asserts its PID is gone. Those assertions passed and cancellation completed in 403 ms. The test then failed at its pre-existing worktree-removal assertion because sandboxed ps returns EPERM; this is not a passing complete suite. The combined run finished with 124 pass and the same 5 environmental failures documented by the independent review. Typecheck reports three errors only in out-of-scope hub files; Biome, lint-rules and check-tool-commands pass.
• Confidence: 95%

Host-specific Developer Tools finding reused a machine-wide cache (eve-bot-lovinka)

• Context: The security analyzer cached findings for 24 hours under its analyzer id, so a different shell host could inherit a stale Developer Tools allowance or warning.
• Commit(s): 79ee90375
• Verdict: accepted
• Code before:

  readonly cacheTtlMs = 24 * 60 * 60 * 1000;

• Code after:

  // Developer Tools depends on this process's host, so machine-wide cached results are unsafe.
  readonly cacheTtlMs = 0;

• How was this fixed: Disabled SecurityAnalyzer caching so the inherited analyze path neither reads stale machine-wide security results nor writes host findings into that cache. The existing developer-tools.test.ts now seeds a cached Terminal finding and verifies two fresh analyses report Editor/cautious and Terminal/safe in sequence, with two actual scans. All 4 tests pass. This reruns the small machine-security checks on each invocation as well.
• Confidence: 98%

Outside drag destination rejected before native flag forwarding (eve-bot-lovinka)

• Context: This duplicates the independent lead finding addressed before the eve threads arrived.
• Commit(s): 884b86223
• Verdict: already done
• Why: Already fixed in 884b862. session.ts:1329 supplies allowOutside only for the drag destination, and point() skips only window containment. Finite numbers, screenshot bounds and start-point validation remain required. The fake-bridge regression checks allowed and refused screen destinations plus image-bound and invalid-number rejection. The lead reran the 129-test suite successfully and confirmed the regression fails with the old session.ts restored.
• Confidence: 99%

Compound build children outlived cancellation (eve-bot-lovinka)

• Context: This duplicates the independent lead finding addressed before the eve threads arrived.
• Commit(s): 884b86223
• Verdict: already done
• Why: Already fixed in 884b862. build.ts:213 starts a detached process group, stopBuild at line 164 sends group SIGTERM then SIGKILL after 250 ms, and stopping release at line 334 waits for that shutdown. The regression now uses a compound command with a separate child that ignores SIGTERM and proves its PID is gone. The lead reran all 129 tests successfully and confirmed this regression fails with the old build.ts restored.
• Confidence: 98%

Documented hand-joined storage-path lint rule is missing (eve-bot-lovinka)

• Context: Valid spec drift. scripts/ci/lint-rules.ts:759 and :1006 still use the homedir-only matcher, and :755-758 explicitly sanctions direct env.tools.getHome() joins. The promised no-hand-joined-genesis-tools rule is absent. The lead kept lint-rules.ts at master's version when the PR was cut (split plan step for 4b0b83f).
• Verdict: no change needed (Claude Opus 5.5 (fable-judge): verdict changed from "left for the lead" to no-change, with the reason)
• Why: Not changed in this PR, on purpose. scripts/ci/lint-rules.ts keeps master's rule here: its comment at lines 755-758 sanctions join(env.tools.getHome(), ".genesis-tools", ...), which appears about 158 times, so a rule that flags every literal would condemn correct code. This PR moves callers to the storage root helper; widening the lint rule waits until no hand-joined caller is left, and the split plan kept lint-rules.ts at master's version for exactly that reason.
• Confidence: 99%

_{Threads: t1 accepted · t2 already done · t3 already done · t4 no change needed}

[eve-bot-lovinka]

🐉 eve review — 🟡 Review comments

ec49101 · 4 actionable findings · reviewed by codex/gpt-6.1-sol · view run ↗

Severity	Count
🟡 Medium	3
🔵 Low	1

Blast radius

• drag (+) → 5 dependent(s) outside this PR: native/ax-tool/SnapshotSupport/UserTakeover.swift, native/ax-tool/SnapshotSupport/CursorFeedback.swift, native/ax-tool/Sources/main.swift, +2 more
• mouse (~) → 4 dependent(s) outside this PR: native/ax-tool/Sources/main.swift, native/ax-tool/Sources/commands/SnapshotRestore.swift, native/ax-tool/Sources/commands/Input.swift, +1 more
• installLaunchd (~) → 2 dependent(s) outside this PR: src/daemon/interactive/menu.ts, src/daemon/commands/install.ts
• generatePlist (~) → 1 dependent(s) outside this PR: src/daemon/lib/launchd.test.ts
• 1 compiler diagnostic(s) on the PR head touch this diff (graph truncated)

ℹ️ Claims vs diff — 3 claims could not be checked from the diff (c1, c2, c3).

[genesiscz]

Review fixes 2026-10-16 21:06 from GPT-6.1 Sol judged by Claude Opus 5.5

Round 2. 4 open threads (eve 4, CodeRabbit 0, humans 0): 2 fixed, 0 rejected, 0 already done, 2 no-change because their shared lint-rule implementation is outside the PR scope. All expanded threads, review bodies and bot PR comments were read from the lead's exports. No additional unthreaded findings were present. Tests: 21 pass; typecheck, Biome, lint-rules, tool-command checks including strict, PID safety and logging guards all pass.

Documented hand-joined storage-path lint rule is absent (eve-bot-lovinka)

• Context: Valid spec drift. The tools rule promises no-hand-joined-genesis-tools, but scripts/ci/lint-rules.ts still sanctions direct joins at lines 755-758 and uses homedir-only matchers at lines 759 and 1006. This repeats the missing enforcement finding from round 1.
• Verdict: no change needed (Claude Opus 5.5 (fable-judge): kept out of this PR on purpose; master's lint-rules.ts sanctions the join)
• Why: Not changed in this PR, on purpose, as in round 1. scripts/ci/lint-rules.ts keeps master's rule: its comment at lines 755-758 sanctions join(env.tools.getHome(), ".genesis-tools", ...), which appears about 158 times, so a rule that flags the literal would condemn correct code. This PR moves callers to the storage root helper; the stricter lint rule follows once no hand-joined caller is left.
• Confidence: 99%

Interactive and kept-worktree builds bypassed Ctrl-C cleanup (eve-bot-lovinka)

• Context: The detached build group cannot receive terminal SIGINT itself. The command wrapper returned early when keepWorktree was set or buildCmd was absent before interactive selection, leaving these builds without cancellation handling.
• Commit(s): 045449f37
• Verdict: accepted
• Code before:

  if (opts.keepWorktree) {
      return action(...args);
  }

• Code after:

  try {
      return await Promise.race([action(...args).then(() => "done" as const), interrupted]);
  } finally {
      printReleased(await releaseBuildWorktrees({ stop: signal.aborted }));
  }

• How was this fixed: Every wrapped action now installs the interrupt handler, including interactive build selection. Both localBuilds and find-commit pass the managed path as an explicit worktree when keepWorktree is requested, using the existing named-worktree retention contract while allowing group shutdown. Existing CLI tests gained two isolated mocked-build subprocess cases: interactive selection without an initial buildCmd and an explicit kept build. Both emit SIGINT at build start, assert exit 130 and stop:true, and check that only the kept case names the managed worktree. Combined CLI and Developer Tools suites pass all 21 tests.
• Confidence: 97%

Partial TCC reads could falsely report Developer Tools off (eve-bot-lovinka)

• Context: An unreadable system database was discarded when the user database could be read. An empty readable user query therefore became a false negative despite an inaccessible authoritative source.
• Commit(s): 045449f37
• Verdict: accepted
• Code before:

  rows = [...(rows ?? []), ...found];

• Code after:

  } catch (error) {
      logger.debug({ error, path }, "could not read Developer Tools grants");
      reads.push(null);
  }

• How was this fixed: Each database retains its own rows or null failure. developerToolStatus returns true if any readable database proves the exact host's grant, null if a grant is absent and any database was unreadable, and false only after complete readable negative evidence. Unknown results are skipped by developerToolsFinding. Read failures are logged with their error and database path. The existing Developer Tools tests cover both partial-read orders, both databases unreadable, readable grants despite a failure, complete empty results and mismatched bundle IDs. All 21 focused tests pass.
• Confidence: 98%

Storage helper documents lint enforcement that is not implemented (eve-bot-lovinka)

• Context: Valid finding with the same root cause as t1. The helper documentation names no-hand-joined-genesis-tools, while the existing lint implementation still checks only homedir forms.
• Verdict: no change needed (Claude Opus 5.5 (fable-judge): kept out of this PR on purpose; master's lint-rules.ts sanctions the join)
• Why: Not changed in this PR, on purpose, as in round 1. scripts/ci/lint-rules.ts keeps master's rule: its comment at lines 755-758 sanctions join(env.tools.getHome(), ".genesis-tools", ...), which appears about 158 times, so a rule that flags the literal would condemn correct code. This PR moves callers to the storage root helper; the stricter lint rule follows once no hand-joined caller is left.
• Confidence: 99%

Commits this round

• 045449f37 fix(control, ts): refactor(tools): every .genesis-tools path comes from one storage root helper, plus small tool, doctor, github and ax-tool fixes #537 followup - cancel every build and preserve unknown grants

_{Threads: t1 no change needed · t2 accepted · t3 accepted · t4 no change needed}

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

045449f · 0 actionable findings · reviewed by codex/gpt-6.1-sol · view run ↗

Blast radius

• registerSourcemapsCommands (~) → 1 dependent(s) outside this PR: src/ts/index.ts

[genesiscz]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 48 minutes.

[genesiscz]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 13 minutes.

[genesiscz]

Review fixes 2026-10-17 02:24 from GPT-6.1 Sol judged by Claude Opus 5.5

Round 3. 0 open threads (eve 0, CodeRabbit 0, humans 0). All lead-exported threads, review bodies and PR comments read; no additional unthreaded findings. Two explicitly requested findings fixed: the independent cancellation/cache defect and the missing storage-path enforcement carried over from rounds 1 and 2. No rejected, already-done or no-change items. Commit 81b0c27. Full seven-file test run: 159 pass, 5 documented sandbox failures. Final focused regressions: 7 pass. Typecheck, Biome, lint-rules and all push guards pass.

A cancelled build exiting zero was stored as complete (independent-review (GPT-6.1 Sol), no thread)

• Context: The independent round 3 review proved that a build with a SIGTERM handler exiting zero could leave partial output committed to the reusable cache. Cancellation stopped its process group but was not recorded as a build failure.
• Commit(s): 81b0c2798
• Verdict: accepted
• Code before:

  if (code !== 0) {
      throw new Error(`build command exited ${code} at ${commit.slice(0, 12)}; log: ${logPath}`);
  }

• Code after:

  const assertNotCancelled = (): void => {
      if (held.cancelled.has(proc) || options.signal?.aborted || held.stopping) {
          throw new Error(`build cancelled at ${commit.slice(0, 12)}; log: ${logPath}`);
      }
  };
  assertNotCancelled();

• How was this fixed: stopBuild records the subprocess in a WeakSet before sending any signal, covering both stopping release and AbortSignal shutdown. Zero-exit builds check cancellation before copying output and again before committing cache metadata; already aborted signals also prevent launch. Two new tests use a real child that writes partial output, handles SIGTERM with exit zero, and cancels via release or signal. Each verifies rejection, no completed cache entry, a subsequent identical recipe executing and writing complete output, then normal cache reuse. Both tests pass, including the final focused run. The combined seven-file run completed with 159 pass and five pre-existing environment-sensitive failures: ps EPERM during worktree removal and a server bind EADDRINUSE. No claim is made that the full suite passed in this sandbox.
• Confidence: 98%

Implement the promised storage-root enforcement carried over from rounds 1 and 2 (eve-bot-lovinka, no thread)

• Context: The two documentation anchors previously answered as no-change promised a no-hand-joined-genesis-tools rule, but the checker only matched homedir forms and still sanctioned direct env.tools.getHome() joins. The PR title says every .genesis-tools path comes from one storage root helper, so the implementation must enforce that intent rather than weaken both documents.
• Commit(s): 81b0c2798
• Verdict: accepted
• Code before:

  { paths, matcher: { rule: { pattern: "$FN(homedir(), $$$ARGS)" } } }

• Code after:

  { paths, matcher: { rule: { pattern: "$FN($$$ARGS)" } } },
  guard((nodes) => {
      recordHandJoinedStorage(nodes, (node) => node.getRoot().filename(), push);
  })

• How was this fixed: Implemented no-hand-joined-genesis-tools in both checkSource and scanAll through one shared call-site checker plus a shared template rule. It checks arbitrary home expressions, method and function call forms, and actual TypeScript templates. It exempts the canonical root implementation, tests and plugins, preserves suppression comments, and avoids similarly named folders, LaunchAgent plist names and quoted shell expansion strings. Migrated 12 remaining paths across 10 files to toolDataDir, genesisToolsDir or genesisToolsDirIn while preserving explicit-home behavior. Thus both existing documents now describe implemented enforcement. The full lint-rule test file passed 41 tests. The first real repo scan found the unmigrated sites; after migration the repo scan passed. A deliberately planted join(home, .genesis-tools, ...) then made the repo guard exit 1 naming the exact script and line. The plant was restored and the final guard passed. Final focused lint and cancellation regressions passed all 7 selected tests. Tests for harvest markers, cache retirement, capture installer/runtime logger and swap scanner passed in the combined run.
• Confidence: 98%

Commits this round

• 81b0c2798 fix(tools): refactor(tools): every .genesis-tools path comes from one storage root helper, plus small tool, doctor, github and ax-tool fixes #537 followup - reject cancelled builds and enforce storage roots

[eve-bot-lovinka]

🐉 eve review — 🟡 Review comments

81b0c27 · 1 actionable finding · reviewed by codex/gpt-6.1-sol · view run ↗

Severity	Count
🟡 Medium	1

Blast radius

• mouse (~) → 5 dependent(s) outside this PR: src/macos/GenesisKit/Sources/GenesisKit/Window/WindowTitlebar.swift, src/macos/GenesisKit/Sources/GenesisKit/Style/TooltipGuard.swift, src/macos/GenesisKit/Sources/GenesisKit/Sessions/Code/SessionCodeBlock.swift, +2 more
• sessionChangesPath (~) → 5 dependent(s) outside this PR: src/agents/commands/changes.ts, src/agents/lib/changes/tool-changes.ts, src/agents/lib/changes/log.test.ts, +2 more
• drag (+) → 3 dependent(s) outside this PR: src/macos/GenesisKit/Sources/GenesisKit/Window/WindowTitlebar.swift, src/macos/GenesisKit/Sources/GenesisKit/Window/ScreenVerticalDragArea.swift, src/macos/GenesisKit/Sources/GenesisKit/Controls/MenuButton.swift
• objectsDir (~) → 3 dependent(s) outside this PR: src/agents/commands/changes.ts, src/agents/lib/changes/tool-changes.ts, src/agents/lib/changes/diff.ts
• createBaselineBenchmarkVariant (~) → 2 dependent(s) outside this PR: scripts/history/benchmark.test.ts, scripts/history/compact-candidate.test.ts
• installLaunchd (~) → 2 dependent(s) outside this PR: src/daemon/commands/install.ts, src/daemon/interactive/menu.ts
• generatePlist (~) → 1 dependent(s) outside this PR: src/daemon/lib/launchd.test.ts
• retireNativeCache (~) → 1 dependent(s) outside this PR: scripts/history/retire-native-cache.test.ts
• 1 compiler diagnostic(s) on the PR head touch this diff (graph truncated)

ℹ️ Claims vs diff — 4 claims could not be checked from the diff (c1, c2, c3, c8).

[genesiscz]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 44 minutes.

[genesiscz]

Review fixes 2026-10-17 03:11 from GPT-6.1 Sol judged by Claude Opus 5.5

Round 4. 1 open thread (eve 1, CodeRabbit 0, humans 0). All exported threads, review bodies and PR comments read; no additional unanswered unthreaded findings. 1 fixed, 0 rejected, 0 already done. Commit 1a4aeed. Swift source and regressions written but not built or tested, per the standing instruction. Typecheck, lint-rules, normal/strict tool-command checks, PID safety, logging and the native-platform manifest test pass.

Mouse-up retained stale window-local coordinates after the posted drag moved the window (eve-bot-lovinka)

• Context: The release event was allocated against the frame read before post(move). If delivery moved the window, normal completion and interruption at the next verification both posted mouse-up with the old local offset. The prior test moved its frame inside verify, which preceded event allocation and missed this ordering.
• Commit(s): 1a4aeedf8
• Verdict: accepted
• Code before:

  post(release)

• Code after:

  func postRelease() {
      if let liveBounds {
          // Posting the last move can move the window after its release event was allocated.
          // Refresh the local field without risking a new allocation after mouse-down.
          setLocation(release, snapshotWindowPoint(release.location, in: liveBounds() ?? bounds))
      }
      post(release)
  }

• How was this fixed: Both normal and catch-path releases now use postRelease, which rereads liveBounds and refreshes the CGEvent window-local field immediately before posting. It keeps the already allocated release event and last delivered global point, preserving the ability to release after mouse-down without requiring another event allocation. Added testCompletedDragReleaseUsesTheFrameMovedByPostingTheLastDrag and testInterruptedDragReleaseUsesTheFrameMovedByPostingTheLastDrag to WindowEventTests.swift. Their shared fixture moves the frame only in post(leftMouseDragged), and checks one mouse-up, the last delivered global point, window identity and a 50,50 local grab offset. On the old source the stale local offset would be 150,50 in both cases. Swift tests were not executed or compiled under the explicit sandbox instruction; the lead must run these tests. Typecheck and all required repository/push guards pass. The native-platform manifest test passes but is not behavioral evidence for this Swift fix.
• Confidence: 95%

Commits this round

• 1a4aeedf8 fix(tools): refactor(tools): every .genesis-tools path comes from one storage root helper, plus small tool, doctor, github and ax-tool fixes #537 followup - refresh drag release coordinates after window movement

_{Threads: t1 accepted}

[eve-bot-lovinka]

🐉 eve review — ✅ Approved

1a4aeed · 0 actionable findings · reviewed by codex/gpt-6.1-sol · view run ↗

[genesiscz]

Review fixes 2026-10-17 07:13 from GPT-6.1 Sol judged by Claude Opus 5.5

Round 9. 3 open threads (eve 2, CodeRabbit 1, humans 0), plus 1 unthreaded CodeRabbit outside-diff finding. 4 fixed, 0 rejected, 0 already done. Review bodies and PR comments were checked; other substantive findings were answered in previous rounds.

Repair command does not quote the checkout path (CR)

• Context: The suggested cd command interpolated a raw workspace path, so spaces or shell metacharacters could change its meaning.
• Commit(s): 30492ad48
• Verdict: accepted
• Code before:

  `repair it with: cd ${workspaceRoot} && bun install`

• Code after:

  `repair it with: cd ${shellQuote(workspaceRoot)} && bun install`

• How was this fixed: Use the existing shellQuote helper when rendering the repair hint. The entrypoint regression renders the actual source template for a temporary checkout containing spaces, an apostrophe, a dollar sign and a semicolon, then executes only its cd prefix plus pwd in a real shell. No install is run. The test fails with the original hint and passes with the fix; all 16 entrypoint tests pass.
• Reply (thread resolved, no thread reply): Fixed in 30492ad. The repair hint now shell-quotes the workspace path while retaining the install and opt-in guidance. A regression renders the actual hint for a path containing spaces and shell metacharacters, then checks its cd prefix in a real shell without running the installer. It fails with the old hint and passes with the fix.
• Confidence: 97%

Failed worktree removals exit successfully (eve-bot-lovinka)

• Context: A prune result can contain kept entries with outcome failed without throwing; the command previously omitted these from failures and exited zero.
• Commit(s): 30492ad48
• Verdict: accepted
• Code before:

  results.push({ project, ...(await new SourcemapCache(project).prune({ maxAgeDays })) });

• Code after:

  const result = await new SourcemapCache(project).prune({ maxAgeDays });
  results.push({ project, ...result });
  for (const kept of result.kept) {
      if (kept.outcome === "failed") {
          failures.push({ project, error: `${kept.worktree}: ${kept.detail ?? "worktree removal failed"}` });
      }
  }

• How was this fixed: Record outcome failed as a project failure, preserve its worktree detail, and keep successful results. The existing failure exit path now covers returned operational failures as well as thrown errors. New text and JSON CLI tests verify exit 1, machine-readable failure details, expected busy retention remaining non-failing, and continued processing of later successful projects. Both new cases fail on the original code and pass after the fix.
• Confidence: 97%

Prune uses an idle-age check from before lock acquisition (eve-bot-lovinka)

• Context: A build can refresh the worktree mtime between the initial age check and lock acquisition, allowing prune to remove a freshly used worktree.
• Commit(s): 30492ad48
• Verdict: accepted
• Code before:

  return await withFileLock(worktreeLockPath(options.cache, worktree), () => removeUnusedWorktree(worktree), 0);

• Code after:

  if (options.idleMs !== undefined) {
      const current = await stat(worktree);
      if (Date.now() - current.mtimeMs < options.idleMs) {
          return { worktree, outcome: "recent", bytes: 0 };
      }
  }
  return removeUnusedWorktree(worktree);

• How was this fixed: Retain the early age check as an optimization, then re-stat and recheck the idle age inside the worktree lock before removal. A deterministic regression creates a real Git worktree and updates its mtime after returning the old initial stat. It verifies the fresh worktree is retained as recent. The test fails on the original implementation and passes with the fix.
• Confidence: 97%

ComputerUse drops final drag window bounds (CR, no thread)

• Context: Native outside drags return windowBoundsAfter, but perform discarded the field. A failed refresh then left the caller without either fresh state or final bounds.
• Commit(s): 30492ad48
• Verdict: accepted
• Code before:

  note: typeof result.note === "string" ? result.note : undefined,

• Code after:

  note: typeof result.note === "string" ? result.note : undefined,
  windowBoundsAfter: windowBoundsSchema.safeParse(result.windowBoundsAfter).data,

• How was this fixed: Forward final bounds after validating finite coordinates and finite positive dimensions. The fake-bridge regression returns a dispatched outside drag whose refresh fails, verifies valid bounds and note survive without state, and rejects non-finite, negative-size and mistyped bounds. The test fails on the original code and passes with the fix.
• Confidence: 97%

Commits this round

• 30492ad48 fix(tools): refactor(tools): every .genesis-tools path comes from one storage root helper, plus small tool, doctor, github and ax-tool fixes #537 followup - report cleanup failures and preserve drag bounds

_{Threads: t1 accepted · t2 accepted · t3 accepted}

[eve-bot-lovinka]

🐉 eve review — Coverage incomplete · approval withheld

b992e7a · 0 actionable findings · ⚠️ degraded pass · reviewed by codex/gpt-6.1-sol · view run ↗

⚠️ Degraded pass — this review did not run at full strength; treat the verdict as partial.

• deep find submitted 0 findings after 15 step(s) on 135 files with no cross-check leg (leg B off) — the empty result is uncorroborated

Blast radius

• mouse (~) → 7 dependent(s) outside this PR: src/macos/GenesisTools/Sources/BrowserURL.swift, src/macos/GenesisTools/Sources/Capsule.swift, src/macos/GenesisTools/Sources/RouteApproval.swift, +4 more
• sessionChangesPath (~) → 5 dependent(s) outside this PR: src/agents/lib/changes/log.test.ts, src/agents/lib/changes/blame.ts, src/agents/lib/changes/tool-changes.ts, +2 more
• drag (+) → 4 dependent(s) outside this PR: src/macos/GenesisTools/Sources/Notify.swift, src/macos/GenesisTools/Sources/App/Views.swift, src/macos/GenesisTools/Sources/Hub/HubPRs.swift, +1 more
• objectsDir (~) → 3 dependent(s) outside this PR: src/agents/lib/changes/tool-changes.ts, src/agents/lib/changes/diff.ts, src/agents/commands/changes.ts
• createBaselineBenchmarkVariant (~) → 2 dependent(s) outside this PR: scripts/history/benchmark.test.ts, scripts/history/compact-candidate.test.ts
• installLaunchd (~) → 2 dependent(s) outside this PR: src/daemon/commands/install.ts, src/daemon/interactive/menu.ts
• generatePlist (~) → 1 dependent(s) outside this PR: src/daemon/lib/launchd.test.ts
• retireNativeCache (~) → 1 dependent(s) outside this PR: scripts/history/retire-native-cache.test.ts
• 1 compiler diagnostic(s) on the PR head touch this diff (graph truncated)

ℹ️ Claims vs diff — 8 claims could not be checked from the diff (c1, c2, c3, c4, c5, c6, c7, c8).