Skip to content

Devin/1790586822 upstream sanitize project context - #877

Open
johnfelipe wants to merge 3 commits into
tractorjuice:mainfrom
johnfelipe:devin/1790586822-upstream-sanitize-project-context
Open

Devin/1790586822 upstream sanitize project context#877
johnfelipe wants to merge 3 commits into
tractorjuice:mainfrom
johnfelipe:devin/1790586822-upstream-sanitize-project-context

Conversation

@johnfelipe

@johnfelipe johnfelipe commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@tractorjuice

tractorjuice commented Sep 30, 2026

Copy link
Copy Markdown
Owner

Thanks. The newline-in-filename injection is real (a file in external/ can forge a ## SYSTEM heading in the context), and flattening plus the text fence fixes it well; the tests are solid. A few things before merge: 1) walkEntries calls lstatSync on the root, so a symlinked external/ directory now lists nothing and silently disappears from the inventory (it did list on main); please follow the root link, or at least report what was skipped. 2) The changelog line landed under [6.16.4]; it belongs under [Unreleased]. 3) The byte-identical Codex copy, extensions/arckit-codex/hooks/project-context-builder.mjs, needs the same change. 4) Could you give the PR a title and description, and consider splitting the walk limits (16 levels, 2,000 entries, which truncate silently) into their own PR?

@tractorjuice tractorjuice mentioned this pull request Sep 30, 2026
Open
devin-ai-integration Bot and others added 3 commits October 1, 2026 19:35
@devin-ai-integration @johnfelipe
fix: sanitize hook context and bound external walks
d6aa27a 
Co-Authored-By: Felipe <ingenierofelipeurrego@gmail.com>
@devin-ai-integration @johnfelipe
fix: reject linked external document events
147baeb 
Co-Authored-By: Felipe <ingenierofelipeurrego@gmail.com>
@devin-ai-integration @johnfelipe
fix(hooks): follow a symlinked external/ root; port context sanitisin…
4ab986a 
…g to the Codex copies

walkEntries used lstat on the root, so a project whose external/ is a
symlink to a shared folder silently produced an empty inventory. The root
is now stat'ed (followed); links below it are still skipped.

The Codex extension's project-context-builder.mjs is the byte-identical
copy and its hook-utils.mjs carries the same bounded walker. Changelog
entry moved under [Unreleased].

Co-Authored-By: Felipe <ingenierofelipeurrego@gmail.com>
@devin-ai-integration
devin-ai-integration Bot force-pushed the devin/1790586822-upstream-sanitize-project-context branch from 3f35053 to 4ab986a Compare October 1, 2026 19:36

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tractorjuice tractorjuice Awaiting requested review from tractorjuice tractorjuice is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@johnfelipe @tractorjuice