fix(agent): render subagent tool failures + harden memory lock symlinks#4507
Conversation
Follow-up to the tinyhumansai#4504 review: - Extract ToolFailureLines into a shared component and render it in the sub-agent renderers (SubagentDrawer rows + ToolTimelineBlock inline rows), so a failed child tool actually SHOWS the why/next copy instead of only storing it on the transcript item (tinyhumansai#4459). - update_memory_md: reject a symlinked `.memory-write.lock` and open it O_NOFOLLOW on Unix, so a project-controlled symlink can't redirect the cross-process flock outside the containment-checked workspace (tinyhumansai#4458). Claude-Session: https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d4269e1ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| #[cfg(unix)] | ||
| { | ||
| // O_NOFOLLOW closes the TOCTOU window: if a symlink is swapped in | ||
| // after the check above, the open fails (ELOOP) rather than follows. | ||
| use std::os::unix::fs::OpenOptionsExt; | ||
| opts.custom_flags(libc::O_NOFOLLOW); | ||
| } |
There was a problem hiding this comment.
This hardening only makes the final open no-follow under cfg(unix). In the supported Windows desktop build, the code still does symlink_metadata followed by a normal OpenOptions::open, so a workspace-controlled process can swap .memory-write.lock to a reparse-point symlink in that gap and redirect the advisory lock outside the containment-checked workspace. Please either reject this path on Windows or open with the Windows no-reparse/fail-if-symlink flags as well.
Useful? React with 👍 / 👎.
1 participant
Second follow-up to the tinyagents-parity work — addresses the two late review findings on #4504 (which merged before they were resolved).
Fixes
failureonto the sub-agent transcript item but no renderer read it, so a failed child tool still showed only "Failed". ExtractsToolFailureLinesinto a shared component and renders it in both sub-agent renderers (SubagentDrawerrows andToolTimelineBlockinline rows), matching the parent processing transcript..memory-write.lockfs2flock added in fix(agent): follow-up review fixes for tinyagents parity (#4451–#4469) #4504 opened the path following symlinks before any containment check. Now rejects a symlinked lock file and opens itO_NOFOLLOWon Unix, so a project-controlled symlink can't redirect the create/open/lock outside the containment-checked workspace.Testing
SubagentDrawer(16) +ProcessingTranscriptViewtests pass; typecheck clean.cargobuilds OOM on this box).Submission Checklist
Refs #4458, #4459.
https://claude.ai/code/session_019j5TLsRLHsM3kqAYFyH4hR