fix: Security vulnerabilities and race conditions from code review #112

coderabbitai · 2026-01-27T07:13:19Z

⚠️ Potential issue | 🟡 Minor

Fix markdown linting issue: add language specifier to fenced code block.

The fenced code block is missing a language identifier, which violates markdown linting rules. Since this block contains instructional comments rather than executable code, consider using text or markdown as the language specifier.

📝 Proposed fix

-``` +```text # 4. Get progress statistics Use the feature_get_stats tool

</details>  <details> <summary>📝 Committable suggestion</summary> > ‼️ **IMPORTANT** > Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements. ```suggestion

🧰 Tools

🪛 markdownlint-cli2 (0.18.1)

23-23: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents

In @.claude/templates/coding_prompt.template.md around lines 23 - 26, The fenced code block containing the lines "# 4. Get progress statistics" and "Use the feature_get_stats tool" is missing a language specifier; update that triple-backtick block to include a language (e.g., text or markdown) so the block becomes ```text ... ``` to satisfy markdown linting rules, leaving the content unchanged.

-Original file line number
+Diff line change
@@ Expand Up @@
     Start by orienting yourself:
     ```bash
-    # 1. See your working directory
-    pwd
+    # 1. See your working directory and project structure
+    pwd && ls -la
-    # 2. List files to understand project structure
-    ls -la
+    # 2. Read recent progress notes (last 100 lines)
+    tail -100 claude-progress.txt
-    # 3. Read the project specification to understand what you're building
-    cat app_spec.txt
-    # 4. Read progress notes from previous sessions (last 500 lines to avoid context overflow)
-    tail -500 claude-progress.txt
-    # 5. Check recent git history
-    git log --oneline -20
+    # 3. Check recent git history
+    git log --oneline -10
     ```
-    Then use MCP tools to check feature status:
+    Then use MCP tools:
     ```
-    # 6. Get progress statistics (passing/total counts)
+    # 4. Get progress statistics
     Use the feature_get_stats tool
     ```
-    Understanding the `app_spec.txt` is critical - it contains the full requirements
-    for the application you're building.
+    **NOTE:** Do NOT read `app_spec.txt` - you'll get all needed details from your assigned feature.
     ### STEP 2: START SERVERS (IF NOT RUNNING)
@@ Expand Down Expand Up @@
     ---
+    ## TOKEN EFFICIENCY
+    To maximize context window usage:
+    - **Don't read files unnecessarily** - Feature details from `feature_get_by_id` contain everything you need
+    - **Be concise** - Short, focused responses save tokens for actual work
+    - **Use `feature_get_summary`** for status checks (lighter than `feature_get_by_id`)
+    - **Avoid re-reading large files** - Read once, remember the content
+    ---
     **Remember:** One feature per session. Zero console errors. All data from real database. Leave codebase clean before ending session.
     ---
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up @@
     Start by orienting yourself:
     ```bash
-    # 1. See your working directory
-    pwd
+    # 1. See your working directory and project structure
+    pwd && ls -la
-    # 2. List files to understand project structure
-    ls -la
+    # 2. Read recent progress notes (last 100 lines)
+    tail -100 claude-progress.txt
-    # 3. Read progress notes from previous sessions (last 200 lines)
-    tail -200 claude-progress.txt
-    # 4. Check recent git history
+    # 3. Check recent git history
     git log --oneline -10
     ```
-    Then use MCP tools to check feature status:
+    Then use MCP tools:
     ```
-    # 5. Get progress statistics
+    # 4. Get progress statistics
     Use the feature_get_stats tool
     ```
@@ Expand Down Expand Up @@
     ---
+    ## TOKEN EFFICIENCY
+    To maximize context window usage:
+    - **Don't read files unnecessarily** - Feature details from `feature_get_by_id` contain everything you need
+    - **Be concise** - Short, focused responses save tokens for actual work
+    - **Use `feature_get_summary`** for status checks (lighter than `feature_get_by_id`)
+    - **Avoid re-reading large files** - Read once, remember the content
+    ---
     ## IMPORTANT REMINDERS
     **Your Goal:** Verify that passing features still work, and fix any regressions found.
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -19,7 +19,7 @@ jobs: @@
           - name: Lint with ruff
             run: ruff check .
           - name: Run security tests
-            run: python test_security.py
+            run: python -m pytest tests/test_security.py tests/test_security_integration.py -v
       ui:
         runs-on: ubuntu-latest
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -7,6 +7,7 @@ @@
     import asyncio
     import io
+    import logging
     import re
     import sys
     from datetime import datetime, timedelta
@@ Expand All / @@ -16,14 +17,17 @@ @@
     from claude_agent_sdk import ClaudeSDKClient
+    # Module logger for error tracking (user-facing messages use print())
+    logger = logging.getLogger(__name__)
     # Fix Windows console encoding for Unicode characters (emoji, etc.)
     # Without this, print() crashes when Claude outputs emoji like ✅
     if sys.platform == "win32":
         sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding="utf-8", errors="replace", line_buffering=True)
         sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace", line_buffering=True)
     from client import create_client
-    from progress import count_passing_tests, has_features, print_progress_summary, print_session_header
+    from progress import count_passing_tests, has_features, print_progress_summary, print_session_header, send_session_event
     from prompts import (
         copy_spec_to_project,
         get_coding_prompt,
@@ Expand Down Expand Up / @@ -106,6 +110,7 @@ async def run_agent_session( @@
             return "continue", response_text
         except Exception as e:
+            logger.error(f"Agent session error: {e}", exc_info=True)
             print(f"Error during agent session: {e}")
             return "error", str(e)
@@ Expand Down Expand Up / @@ -163,6 +168,15 @@ async def run_autonomous_agent( @@
         is_initializer = agent_type == "initializer"
+        # Send session started webhook
+        send_session_event(
+            "session_started",
+            project_dir,
+            agent_type=agent_type,
+            feature_id=feature_id,
+            feature_name=f"Feature #{feature_id}" if feature_id else None,
+        )
         if is_initializer:
             print("Running as INITIALIZER agent")
             print()
@@ Expand Down Expand Up / @@ -236,6 +250,7 @@ async def run_autonomous_agent( @@
                 async with client:
                     status, response = await run_agent_session(client, prompt, project_dir)
             except Exception as e:
+                logger.error(f"Client/MCP server error: {e}", exc_info=True)
                 print(f"Client/MCP server error: {e}")
                 # Don't crash - return error status so the loop can retry
                 status, response = "error", str(e)
@@ Expand Down Expand Up / @@ -291,6 +306,7 @@ async def run_autonomous_agent( @@
                             target_time_str = target.strftime("%B %d, %Y at %I:%M %p %Z")
                         except Exception as e:
+                            logger.warning(f"Error parsing reset time: {e}, using default delay")
                             print(f"Error parsing reset time: {e}, using default delay")
                 if target_time_str:
@@ Expand Down Expand Up / @@ -327,6 +343,7 @@ async def run_autonomous_agent( @@
                 await asyncio.sleep(delay_seconds)
             elif status == "error":
+                logger.warning("Session encountered an error, will retry")
                 print("\nSession encountered an error")
                 print("Will retry with a fresh session...")
                 await asyncio.sleep(AUTO_CONTINUE_DELAY_SECONDS)
@@ Expand Down Expand Up / @@ -354,4 +371,18 @@ async def run_autonomous_agent( @@
         print("\n  Then open http://localhost:3000 (or check init.sh for the URL)")
         print("-" * 70)
+        # Send session ended webhook
+        passing, in_progress, total = count_passing_tests(project_dir)
+        send_session_event(
+            "session_ended",
+            project_dir,
+            agent_type=agent_type,
+            feature_id=feature_id,
+            extra={
+                "passing": passing,
+                "total": total,
+                "percentage": round((passing / total) * 100, 1) if total > 0 else 0,
+            }
+        )
         print("\nDone!")

-Original file line number
+Diff line change
@@ Expand Up / @@ -5,6 +5,23 @@ @@
     Database models and utilities for feature management.
     """
-    from api.database import Feature, create_database, get_database_path
+    from api.agent_types import AgentType
+    from api.config import AutocoderConfig, get_config, reload_config
+    from api.database import Feature, FeatureAttempt, FeatureError, create_database, get_database_path
+    from api.feature_repository import FeatureRepository
+    from api.logging_config import get_logger, setup_logging
-    __all__ = ["Feature", "create_database", "get_database_path"]
+    __all__ = [
+        "AgentType",
+        "AutocoderConfig",
+        "Feature",
+        "FeatureAttempt",
+        "FeatureError",
+        "FeatureRepository",
+        "create_database",
+        "get_config",
+        "get_database_path",
+        "get_logger",
+        "reload_config",
+        "setup_logging",
+    ]

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Security vulnerabilities and race conditions from code review #112

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai bot Jan 27, 2026

Uh oh!

Uh oh!

Uh oh!

-Original file line number
+Diff line change
@@ -0,0 +1,29 @@
+    """
+    Agent Types Enum
+    ================
+    Defines the different types of agents in the system.
+    """
+    from enum import Enum
+    class AgentType(str, Enum):
+        """Types of agents in the autonomous coding system.
+        Inherits from str to allow seamless JSON serialization
+        and string comparison.
+        Usage:
+            agent_type = AgentType.CODING
+            if agent_type == "coding":  # Works due to str inheritance
+                ...
+        """
+        INITIALIZER = "initializer"
+        CODING = "coding"
+        TESTING = "testing"
+        def __str__(self) -> str:
+            """Return the string value for string operations."""
+            return self.value

fix: Security vulnerabilities and race conditions from code review #112

Are you sure you want to change the base?

Uh oh!

fix: Security vulnerabilities and race conditions from code review #112

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai bot Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!