Skip to content

feat(agi): stream fix, persistence defaults, infra specialist, Aria wiring#462

Merged
Bryan-Roe merged 31 commits into
mainfrom
cursor/agi-six-item-bundle-8efe
Jun 21, 2026
Merged

feat(agi): stream fix, persistence defaults, infra specialist, Aria wiring#462
Bryan-Roe merged 31 commits into
mainfrom
cursor/agi-six-item-bundle-8efe

Conversation

@Bryan-Roe

@Bryan-Roe Bryan-Roe commented Jun 20, 2026

Copy link
Copy Markdown
Owner

Summary

Implements all six AGI follow-up items from the orientation plan: SSE stream compatibility, persistence defaults, LM Studio routing verification, a new infrastructure specialist agent, CI hardening, and Aria provider wiring.

Changes

  • Stream fix: Add _materialize_sse_body() / _make_sse_response() in function_app.py so /api/agi/stream (and other SSE routes) work with azure-functions 1.x, which only accepts str/bytes bodies.
  • Persistence: Default JSONL audit path to data_out/agi_reasoning.jsonl; enable writes when QAI_AGI_PERSIST defaults to true; /api/agi/persistence returns JSONL metadata instead of 404 when unconfigured.
  • LM Studio: Add routing regression test in tests/test_lmstudio_agi_integration.py.
  • New agent: Register infrastructure-specialist with domain detection for deploy/CI/CD/DevOps queries.
  • CI hardening: Extend agi-smoke.yml with stream materialization and LM Studio routing tests.
  • Aria integration: Accept agi / agi-reasoning provider aliases in /api/aria/command; expose agi in health payload supported_providers.

Verification

  • pytest tests/test_agi_smoke.py tests/test_agi_provider.py tests/test_agi_persistence_endpoint.py tests/test_agi_persistence_auth.py tests/test_lmstudio_agi_integration.py tests/test_function_app_endpoints.py::TestAgiEndpoints tests/test_aria_server.py::test_parse_accepts_agi_provider_alias tests/test_aria_server.py::test_health_payload_includes_agi_provider_support -q122 passed
  • Live checks:
    • POST /api/agi/stream returns SSE event: meta + data: {"delta": ...} + [DONE]
    • GET /api/agi/persistence?limit=3 returns backend: jsonl with entries
Open in Web Open in Cursor 

Summary by Sourcery

Ensure AGI streaming, persistence, routing, and Aria integration behave consistently across environments and providers.

New Features:

  • Introduce an infrastructure-specialist AGI agent and route infrastructure and DevOps queries to it.
  • Expose AGI as a supported provider in the Aria server health payload and accept agi/agi-reasoning provider aliases.

Enhancements:

  • Unify SSE response handling via helper utilities to support environments that require materialized response bodies.
  • Default AGI JSONL persistence to a stable path with metadata in the persistence endpoint response and enable persistence by default.
  • Improve LM Studio and AGI agent routing to better target specialist agents for general Q&A and infrastructure domains.

CI:

  • Extend the agi-smoke CI workflow to run LM Studio integration tests and AGI stream SSE sentinel tests.

Tests:

  • Add tests for AGI SSE stream output materialization, LM Studio specialist routing, AGI infrastructure domain detection, and infrastructure-specialist agent selection.
  • Extend persistence endpoint tests to cover default JSONL paths and Aria server tests to verify AGI provider alias parsing and health payload contents.

…iring

- Materialize SSE generator bodies for azure-functions 1.x compatibility
- Default AGI JSONL persistence and expose /api/agi/persistence without 404
- Add infrastructure-specialist agent and domain routing
- Wire Aria command parser to accept agi/agi-reasoning provider aliases
- Expand AGI smoke CI with stream and LM Studio routing coverage

Co-authored-by: Bryan
Copilot AI review requested due to automatic review settings June 20, 2026 16:12

Copilot AI commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

@Bryan-Roe Thanks for sending me some feedback. Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository. The error I am seeing is:

no `copilot-setup-steps` job found in your `copilot-setup-steps.yml` workflow file. Please ensure you have a single job named `copilot-setup-steps`. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please let me know in a comment and I'll try again. Thanks!

@sourcery-ai

sourcery-ai Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Reviewer's Guide

Adds a shared SSE response helper compatible with azure-functions 1.x, introduces default JSONL persistence behavior and richer metadata for the AGI persistence endpoint, wires a new infrastructure-specialist agent and infrastructure domain routing, extends Aria to recognize AGI provider aliases and expose AGI support in health checks, and hardens CI/tests for AGI streaming and LM Studio routing.

Flow diagram for shared SSE response helper

flowchart LR
    Client[[SSE_client]] --> Endpoint
    subgraph FunctionApp
        Endpoint["SSE endpoint
(e.g. agi_stream)"] --> SSEGen["_sse_iterable
/ blocked_sse
/ sse_iterable
/ _unavail
/ _sse_generator"]
        SSEGen --> MakeResp["_make_sse_response"]
        MakeResp --> Materialize["_materialize_sse_body"]
        Materialize --> HttpResp["func.HttpResponse
body: bytes"]
    end
    HttpResp --> AzureRuntime[[azure_functions_1x]]
Loading

Flow diagram for infrastructure domain routing to infrastructure-specialist agent

flowchart LR
    UserQuery[[user_query]] --> Analyze
    Analyze["AgiProvider._analyze_query"] --> DomainCheck

    subgraph DomainDetection
        DomainCheck -->|contains deploy/kubernetes/docker/...| InfraDomain["domain = infrastructure"]
        DomainCheck -->|other keywords| OtherDomain["domain = quantum/aria/ai/technical/general"]
    end

    InfraDomain --> SelectAgent["select infrastructure-specialist agent config"]
    SelectAgent --> ProviderAgi["provider = agi"]
Loading

Flow diagram for Aria AGI provider alias normalization and health payload

flowchart LR
    CmdReq[[aria_command_request]] --> AliasInput
    AliasInput["provider param
(e.g. agi-reasoning)"] --> Normalize
    Normalize["_normalize_provider_alias"] --> ProviderAgi["normalized provider = agi"]

    HealthReq[[health_check_request]] --> BuildHealth
    BuildHealth["build_health_payload"] --> Fields

    subgraph HealthPayload
        Fields --> LlmAvailable["llm_available"]
        Fields --> AgiSupported["agi_provider_supported"]
        Fields --> SupportedProviders["supported_providers
includes agi"]
    end
Loading

File-Level Changes

Change Details Files
Centralize SSE HttpResponse construction and ensure bodies are materialized for azure-functions 1.x compatibility.
  • Introduce _materialize_sse_body to join/generate byte bodies from various input types including generators, strings, and bytes.
  • Introduce _make_sse_response to build standard SSE HttpResponse objects with CORS and no-cache headers.
  • Refactor AGI, blocked, quantum, and other SSE endpoints to use _make_sse_response instead of passing generators directly to HttpResponse.
  • Adjust AGI stream test to assert against resp.get_body() rather than a monkeypatched HttpResponse.
function_app.py
tests/test_function_app_endpoints.py
tests/test_agi_smoke.py
Make AGI JSONL persistence enabled by default with a stable default path and richer endpoint metadata.
  • Add _default_agi_persist_jsonl_path helper to define a canonical data_out/agi_reasoning.jsonl location.
  • Update agi_persistence endpoint to use the default JSONL path, treat JSONL as the backend when no SQLite config exists, and always return backend/path/configured metadata instead of 404.
  • Add tests to verify default JSONL behavior and returned metadata structure.
  • Change AGI CLI persistence wiring so QAI_AGI_PERSIST defaults to true unless explicitly disabled.
function_app.py
ai-projects/chat-cli/src/agi_provider.py
tests/test_agi_persistence_endpoint.py
Introduce an infrastructure-specialist AGI agent and route relevant queries to the infrastructure domain.
  • Register a new infrastructure-specialist agent with infrastructure domain, DevOps-focused intents, templates, and description.
  • Extend domain documentation and keyword detection to include infrastructure-specific terms (deploy, kubernetes, pipelines, devops, etc.).
  • Add tests to ensure infrastructure queries map to the infrastructure domain and select the infrastructure-specialist agent with a sufficient score.
ai-projects/chat-cli/src/agi_provider.py
tests/test_agi_provider.py
Extend Aria to recognize AGI provider aliases and surface AGI support in health payloads.
  • Update build_health_payload to include agi_provider_supported and a supported_providers list containing agi.
  • Normalize agi-reasoning/agi_reasoning as aliases for the agi provider in provider detection.
  • Add tests verifying provider alias normalization, explicit provider resolution to agi, and health payload contents.
apps/aria/server.py
tests/test_aria_server.py
Harden CI and LM Studio integration tests around AGI routing and streaming.
  • Add LM Studio specialist routing test to ensure general Q&A can route to lmstudio-specialist and integrate it into the LM Studio integration suite.
  • Include LM Studio integration and AGI stream SSE tests in the agi-smoke GitHub Actions workflow matrix.
  • Document live verification steps in the PR body for AGI stream and persistence endpoints.
tests/test_lmstudio_agi_integration.py
.github/workflows/agi-smoke.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

"DEFAULT_AI_PROVIDER": "auto",
"# Aria web UI LLM provider (ollama|lmstudio|auto|local|azure) - set azure to match Azure OpenAI; falls back to DEFAULT_AI_PROVIDER": "",
"ARIA_LLM_PROVIDER": ""
"# Aria web UI LLM provider (ollama|lmstudio|auto|local|azure|agi) - set azure to match Azure OpenAI; falls back to DEFAULT_AI_PROVIDER": "",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
Possibly found usage of AI: OpenAI

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detect-generic-ai-oai.

You can view more details about this finding in the Semgrep AppSec Platform.

Comment thread apps/aria/server.py
"ollama",
"lmstudio",
"azure",
"openai",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
Possibly found usage of AI: OpenAI

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detect-generic-ai-oai.

You can view more details about this finding in the Semgrep AppSec Platform.

@github-actions

github-actions Bot commented Jun 20, 2026

Copy link
Copy Markdown

🟡 Coverage — 007e417

Metric Value
Total coverage 65.4%
▲ vs main +0.1%
Minimum threshold 60%

Updated on every push · 2026-06-21

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR implements a batch of AGI follow-up items: it centralizes Server-Sent Events (SSE) response handling in function_app.py to work around azure-functions 1.x not accepting generator bodies, makes AGI JSONL persistence enabled-by-default with a stable path (and returns JSONL metadata instead of a 404 when unconfigured), adds an infrastructure-specialist agent with an infrastructure domain to the AGI router, and wires the agi/agi-reasoning provider aliases plus a supported_providers health field into the Aria server. It fits into the Functions integration layer and the AGI provider that powers /api/agi/* and Aria command parsing.

Changes:

  • Add _materialize_sse_body() / _make_sse_response() helpers and route all SSE endpoints through them; default AGI persistence to data_out/agi_reasoning.jsonl and enable it by default.
  • Register infrastructure-specialist agent and add infrastructure domain keyword detection in _analyze_query.
  • Expose agi in the Aria health payload's supported_providers and accept agi/agi-reasoning aliases; extend tests and the agi-smoke CI workflow.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
function_app.py Adds SSE materialization helpers, routes all stream endpoints through them, and reworks the persistence endpoint to default to JSONL metadata.
ai-projects/chat-cli/src/agi_provider.py Adds infrastructure-specialist agent, infrastructure domain detection, and defaults QAI_AGI_PERSIST to enabled.
apps/aria/server.py Adds agi_provider_supported/supported_providers to the health payload and agi/agi-reasoning alias mapping.
local.settings.json.example Documents agi provider option and new QAI_AGI_PERSIST* defaults.
.github/workflows/agi-smoke.yml Runs LM Studio routing and AGI stream sentinel tests in CI.
tests/test_function_app_endpoints.py Simplifies the stream test to read the materialized response body directly.
tests/test_agi_smoke.py Adds a test for _materialize_sse_body joining generator chunks.
tests/test_agi_provider.py Adds infrastructure domain detection and infrastructure-specialist routing tests.
tests/test_agi_persistence_endpoint.py Adds a default-JSONL-path persistence test.
tests/test_lmstudio_agi_integration.py Adds an LM Studio specialist routing test.
tests/test_aria_server.py Adds AGI alias parsing and health-payload AGI-support tests.

Comment thread function_app.py
Comment on lines +958 to +959
path = jsonl_path or default_jsonl_path
if jsonl_path or jsonl_enabled or os.path.exists(path) or not sqlite_path:
},
"infrastructure-specialist": {
"domains": ["infrastructure"],
"intents": ["explanation", "question", "coding", "creation", "debugging"],
Comment thread apps/aria/server.py
Comment on lines +337 to +347
"agi_provider_supported": bool(llm),
"supported_providers": [
"auto",
"local",
"ollama",
"lmstudio",
"azure",
"openai",
"quantum",
"agi",
],
@cursor

cursor Bot commented Jun 20, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7fab62b8-ca50-4756-b1ad-dfa7c690aeb1)

…dies

Update TestPostValidation chat_stream tests to read SSE via resp.get_body()
after _make_sse_response materializes generators. Fix yamllint bracket and
comment spacing in agi-smoke.yml.

Co-authored-by: Bryan <bryan@users.noreply.github.com>
@cursor

cursor Bot commented Jun 20, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_17a94df7-df51-435c-ba27-436da9d91ce6)

- Add AGI mode toggle and SSE streaming in chat.js and index.html
- Serve agi_stream_utils.js via /api/chat-web/static/agi_stream_utils.js
- Add agi_analyze and agi_reason MCP tools with import-safe server boot
- Fix devcontainer LM Studio URL test isolation and add MCP/endpoint tests

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 20, 2026 18:03
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 20, 2026 18:03
Comment thread apps/chat/chat.js Fixed
payload = run_agi_reason(query="hello agi")

assert payload["success"] is True
assert payload["response"] == "Reasoned AGI response"
Comment thread tests/test_lmstudio_mcp_agi_tools.py Fixed
Comment thread tests/test_lmstudio_mcp_agi_tools.py Fixed
@github-actions

github-actions Bot commented Jun 20, 2026

Copy link
Copy Markdown

🔐 CodeQL — Open Alerts on this PR

Severity Count
error 7

Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.
See the full list in the Security tab.

max_tokens: int = DEFAULT_MAX_TOKENS,
timeout: float = 30.0,
):
if httpx is None:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
Found identical comparison using is. Ensure this is what you intended.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by identical-is-comparison.

You can view more details about this finding in the Semgrep AppSec Platform.

Comment thread apps/chat/chat.js

if (outputText) {
try {
contentDiv.innerHTML = (reasoningHtml ? reasoningHtml : '') + marked.parse(outputText);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
User controlled data in a contentDiv.innerHTML is an anti-pattern that can lead to XSS vulnerabilities

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by insecure-innerhtml.

You can view more details about this finding in the Semgrep AppSec Platform.

Comment thread apps/chat/chat.js
reasoningHtml += renderAgiDeltaHtml(delta);
}

contentDiv.innerHTML = reasoningHtml + '<div class="agi-final-output">' + outputText.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;') + '</div>';

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
User controlled data in a contentDiv.innerHTML is an anti-pattern that can lead to XSS vulnerabilities

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by insecure-innerhtml.

You can view more details about this finding in the Semgrep AppSec Platform.

Comment thread apps/chat/chat.js

if (outputText) {
try {
contentDiv.innerHTML = (reasoningHtml ? reasoningHtml : '') + marked.parse(outputText);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by insecure-document-method.

You can view more details about this finding in the Semgrep AppSec Platform.

Comment thread apps/chat/chat.js
reasoningHtml += renderAgiDeltaHtml(delta);
}

contentDiv.innerHTML = reasoningHtml + '<div class="agi-final-output">' + outputText.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;') + '</div>';

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by insecure-document-method.

You can view more details about this finding in the Semgrep AppSec Platform.

@bryan-roe-bot

bryan-roe-bot Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Semgrep found 1 insecure-document-method finding:

Detected the use of an inner/outerHTML assignment. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use a dangerous web API, consider using a sanitization library such as DOMPurify to sanitize the HTML before it is assigned.

- Set ARIA_EMBEDDED=true and null-safe optional controls in chat.js
- Add agi_stream_utils route to http_chat_web and expand ai/routes lists
- Extend integration_smoke AGI probes, static asset check, and schema tests
- Broaden agi-smoke.yml coverage with MCP tools and 30s timeout

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 20, 2026 18:17
Copilot AI review requested due to automatic review settings June 21, 2026 01:31
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 01:31
Keep branch total_steps schema fix and main results key check.

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 21, 2026 01:34
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 01:34
Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 21, 2026 01:36
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 01:36
Comment on lines 49 to 73
@@ -66,7 +67,7 @@ jobs:
exit 1
fi
}

validate_threshold "${{ inputs.fitness_threshold }}" "fitness_threshold"
validate_threshold "${{ inputs.stability_threshold }}" "stability_threshold"
echo "✓ All inputs validated successfully"

@bryan-roe-bot bryan-roe-bot Bot Jun 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

🎈 Fixed in commit d62288e 🎈

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale comment

Not approving: Cursor Bugbot is still pending after the 8-minute polling window and no Bugbot review comment (<!-- BUGBOT_REVIEW -->) was posted, so the required automated review signal is missing. Human review is needed before merge; no reviewers were assigned because Bryan-Roe is the sole code owner and PR author.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Approver

@cursor

cursor Bot commented Jun 21, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_23e26b73-bca2-402b-be1a-cd07a6ce27ec)

…icts

Take main's local_dev_adapter CI path and _sse_response helpers while
keeping PR AGI persistence defaults and strict-mode endpoint gating.

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 21, 2026 01:53
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 01:53

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not approving: Cursor Bugbot is still pending after the 8-minute polling window and no Bugbot review comment (<!-- BUGBOT_REVIEW -->) was posted for the current head, so the required automated review signal is missing. Human review is needed before merge; no reviewers were assigned because Bryan-Roe is the sole code owner and PR author.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Approver

@cursor

cursor Bot commented Jun 21, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_f7a6b6a6-d8c8-4afb-a8d1-543b74953360)

- Add _materialize_sse_body alias for _sse_body_bytes
- Use resp.get_body() in SSE stream endpoint tests
- Pin LMSTUDIO_MODEL in provider detection test
- Use hmac.compare_digest for AGI persistence token check
- Fix MD060 compact table formatting in docs

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 21, 2026 02:30
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 02:30
@cursor

cursor Bot commented Jun 21, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d495a275-1693-4828-9c2d-3cbe301b295d)

- Use libasound2t64 on Ubuntu 24.04 for Pyppeteer Chromium deps
- Bind Aria server to 0.0.0.0 and point remote Chrome at host.docker.internal
- Grant workflows: write to CodeQL autofix job for workflow YAML pushes

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 21, 2026 02:51
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 02:51
- Keep set -e-safe retry increment in contract gate loop
- Keep resp.get_body() SSE assertions from PR branch (drop unused capture helper)
- Align quantum integration test job name with main (smoke)

Co-authored-by: Bryan <bryan@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 21, 2026 02:56
@Bryan-Roe Bryan-Roe removed the request for review from Copilot June 21, 2026 02:56
@cursor

cursor Bot commented Jun 21, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_49faea2e-5389-4ee0-b343-9a6ab346b83a)

Signed-off-by: Bryan <74067792+Bryan-Roe@users.noreply.github.com>
@Bryan-Roe Bryan-Roe merged commit c9c8782 into main Jun 21, 2026
34 of 50 checks passed
@cursor

cursor Bot commented Jun 21, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_27a154f4-e9f7-44f5-a937-2928cc297d5a)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants