feat(toolchain): wire CodeGraph and OpenSrc by default - #762
Merged
NagyVikt merged 28 commits intoSep 1, 2026
Merged
Conversation
NagyVikt
commented
Aug 31, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
3 finding(s) — 🟡 3 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:383 |
The installer overwrites a repository's pre-existing codegraph MCP definition and the uninstaller later deletes it as though Guardex |
| 🟡 medium | src/cli/commands/claude.js:520-522 |
The check accepts any truthy MCP entry instead of verifying the managed server specification. |
| 🟡 medium | src/toolchain/index.js:570-575 |
The backup stops reflecting the pre-install state after the first run. |
Provider codex · commit 67dce55
NagyVikt
marked this pull request as ready for review
August 31, 2026 16:11
NagyVikt
force-pushed
the
agent/codex/default-codegraph-and-opensrc-integratio-2026-08-31-17-52
branch
from
August 31, 2026 16:25
67dce55 to
27aa584
Compare
NagyVikt
commented
Aug 31, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:423-426 |
Stale MCP ownership state survives when .mcp.json is missing. |
Provider codex · commit 27aa584
NagyVikt
commented
Aug 31, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
2 finding(s) — 🟡 1 medium · 🔵 1 low
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:427-429 |
An orphaned ownership record is retained when .mcp.json has been removed. |
| 🔵 low | src/cli/commands/claude.js:658-660 |
Uninstall reports that managed servers were pruned even when uninstallMcpServer returned preserved and changed nothing. |
⚠️ 2 finding(s) could not be anchored to the diff
These line numbers are outside the reviewed hunks, so GitHub cannot host them as inline comments.
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:427-429 |
An orphaned ownership record is retained when .mcp.json has been removed. |
| 🔵 low | src/cli/commands/claude.js:658-660 |
Uninstall reports that managed servers were pruned even when uninstallMcpServer returned preserved and changed nothing. |
Provider codex · commit 77b1b32 ·
added 4 commits
September 1, 2026 12:31
Install both companion CLIs, configure CodeGraph MCP safely for Codex and Claude, and distribute OpenSrc routing guidance and skills.\n\nConstraint: Preserve existing global Codex config with Guardex backups before external writes.\nTested: node --test test/claude-install.test.js test/status.test.js; node --test test/setup.test.js; npm run lint; npm run package:check
Restore repository MCP definitions during uninstall, validate exact managed specs, and rotate CodeGraph config backups on retries.\n\nTested: node --test test/claude-install.test.js\nTested: node --test test/setup.test.js\nTested: npm run lint\nTested: npm run package:check
Clear orphaned ownership metadata when repository MCP configuration disappears so later installs cannot restore obsolete user definitions.\n\nTested: node --test test/claude-install.test.js\nTested: npm run lint
Do not count user-modified MCP definitions as removed during Claude integration uninstall.\n\nTested: node --test test/claude-install.test.js\nTested: npm run lint
NagyVikt
force-pushed
the
agent/codex/default-codegraph-and-opensrc-integratio-2026-08-31-17-52
branch
from
September 1, 2026 10:39
1d729ee to
0dc1635
Compare
Collaborator
Author
|
Review findings addressed and verified after rebasing onto current
Verification: targeted Claude/setup/status tests passed; full suite passed (1118 pass, 0 fail, 1 skip); format, lint, package check, and Trivy HIGH/CRITICAL gate passed. |
NagyVikt
marked this pull request as draft
September 1, 2026 10:40
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟠 1 high
⛔ Merge gate: blocked — 1 blocking finding(s) (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟠 high | src/cli/commands/claude.js:407-413 |
Reinstalling after a user edits a managed MCP definition discards that edit and retains stale ownership metadata. |
Provider codex · commit 0dc1635
Preserve user MCP edits made after the initial managed installation. Tested: node --test --test-reporter=dot test/claude-install.test.js
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:364-366 |
MCP definitions are compared using property-order-sensitive JSON serialization. |
Provider codex · commit 2cccbbc
NagyVikt
marked this pull request as ready for review
September 1, 2026 10:44
Avoid reinstall churn when JSON object keys are reordered. Tested: node --test --test-reporter=dot test/claude-install.test.js
NagyVikt
marked this pull request as draft
September 1, 2026 10:46
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
2 finding(s) — 🟠 1 high · 🟡 1 medium
⛔ Merge gate: blocked — 1 blocking finding(s) (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟠 high | src/toolchain/index.js:615-617 |
A failed CodeGraph installer leaves partially modified global Codex configuration in place. |
| 🟡 medium | src/cli/commands/claude.js:397-399 |
An unchanged MCP configuration can retain stale ownership metadata from a deleted and recreated .mcp.json. |
Provider codex · commit 803121c
Restore global Codex files after installer failure and invalidate MCP ownership when the config file is recreated. Tested: node --test --test-reporter=dot test/claude-install.test.js test/setup.test.js
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:423-424 |
Stale ownership state is reused after .mcp.json has been replaced. |
Provider codex · commit 120f964
NagyVikt
marked this pull request as ready for review
September 1, 2026 10:53
Constraint: Preserve exact user-owned managed definitions during later uninstall. Tested: node --test --test-reporter=dot test/claude-install.test.js; npx biome lint src/cli/commands/claude.js test/claude-install.test.js; git diff --check
NagyVikt
marked this pull request as draft
September 1, 2026 10:54
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/toolchain/index.js:594-596 |
The configuration check mistakes one TOML section for a complete CodeGraph installation. |
Provider codex · commit 703520a
NagyVikt
marked this pull request as ready for review
September 1, 2026 10:55
Constraint: Treat Codex MCP registration as complete only when its global AGENTS.md also exists. Tested: node --test --test-reporter=dot test/claude-install.test.js test/setup.test.js; npx biome lint src/toolchain/index.js test/setup.test.js; git diff --check
NagyVikt
marked this pull request as draft
September 1, 2026 10:58
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
2 finding(s) — 🟠 1 high · 🟡 1 medium
⛔ Merge gate: blocked — 1 blocking finding(s) (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟠 high | src/cli/commands/claude.js:34 |
The gitguardex skill source path no longer points to the existing packaged skill directory. |
| 🟡 medium | src/toolchain/index.js:593-595 |
The already-configured check accepts any CodeGraph section header without verifying that it contains a usable command and arguments. |
Provider codex · commit 930fe3c
- HIGH src/cli/commands/claude.js:34 The gitguardex skill source path no longer points to the existing packaged skill directory. The previous implementation loaded it from `.claude/skills/gitguardex`, so installations will silently report a source-missing entry and omit the core gitguardex skill.
NagyVikt
marked this pull request as ready for review
September 1, 2026 11:58
NagyVikt
marked this pull request as draft
September 1, 2026 12:03
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟠 1 high
⛔ Merge gate: blocked — 1 blocking finding(s) (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟠 high | src/toolchain/index.js:648-658 |
The CodeGraph detector ignores valid TOML inline and parent-table definitions. |
Provider codex · commit fd1721c
- HIGH src/toolchain/index.js:658 The CodeGraph detector ignores valid TOML inline and parent-table definitions. Configurations such as `mcp_servers.codegraph = { command = "codegraph", args = ["serve", "--mcp"] }` or `[mcp_servers]\ncodegraph = {...}` are treated as missing, so the installer may append a second definition for the same key; the subsequent textual verification can accept that duplicate even though it makes the Codex TOML invalid.
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:452 |
A truthy non-object mcpServers value is accepted and then mutated as though it were a map. |
Provider codex · commit f72c986
NagyVikt
marked this pull request as ready for review
September 1, 2026 12:09
Prevent false-success installs when .mcp.json or mcpServers is not an object.\n\nTested: node --test --test-reporter=dot test/claude-install.test.js\nTested: node --test --test-reporter=dot test/setup.test.js\nTested: npx biome lint src/cli/commands/claude.js test/claude-install.test.js src/toolchain/index.js test/setup.test.js
NagyVikt
marked this pull request as draft
September 1, 2026 12:11
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
2 finding(s) — 🟡 2 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:489 |
Installing a partially mismatched managed MCP server discards all user-defined fields on that server. |
| 🟡 medium | src/toolchain/index.js:653 |
The hand-written TOML scanner treats table-looking lines inside multiline strings as actual sections. |
Provider codex · commit fd7c36a
NagyVikt
marked this pull request as ready for review
September 1, 2026 12:13
Keep user-defined MCP fields while repairing managed keys and ignore CodeGraph-looking TOML inside multiline strings.\n\nTested: node --test --test-reporter=dot test/claude-install.test.js\nTested: node --test --test-reporter=dot test/setup.test.js\nTested: npx biome lint src/cli/commands/claude.js test/claude-install.test.js src/toolchain/index.js test/setup.test.js
NagyVikt
marked this pull request as draft
September 1, 2026 12:20
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
2 finding(s) — 🟠 1 high · 🟡 1 medium
⛔ Merge gate: blocked — 1 blocking finding(s) (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟠 high | src/cli/commands/claude.js:373 |
Conflicting MCP transport fields are incorrectly treated as compatible. |
| 🟡 medium | src/cli/commands/claude.js:450-453 |
A JSON null root is silently converted into an empty object. |
Provider codex · commit 72b6382
- HIGH src/cli/commands/claude.js:373 Conflicting MCP transport fields are incorrectly treated as compatible. A definition such as `{type:"http",url:"https://attacker",command:"gx",args:["mcp","serve"]}` passes this subset comparison, so installation and checks can accept a remote server instead of the intended local stdio command; the merge path also preserves these conflicting fields. Compatibility and installation must reject or remove transport fields that conflict with each managed specification.
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/cli/commands/claude.js:580-588 |
Uninstall cannot restore pre-existing MCP definitions containing conflicting transport fields. |
Provider codex · commit 3ea165e
NagyVikt
marked this pull request as ready for review
September 1, 2026 12:25
Reject null MCP roots and reconstruct sanitized managed definitions before restoring their user-owned transport fields.\n\nTested: node --test --test-reporter=dot test/claude-install.test.js\nTested: npx biome lint src/cli/commands/claude.js test/claude-install.test.js
NagyVikt
marked this pull request as draft
September 1, 2026 12:26
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
1 finding(s) — 🟡 1 medium
✅ Merge gate: pass — no blocking findings (blocks on high/critical).
| Severity | Location | Finding |
|---|---|---|
| 🟡 medium | src/toolchain/index.js:738-739 |
Bracket depth is counted inside quoted TOML strings, so valid CodeGraph sections can be misclassified as unconfigured. |
Provider codex · commit 2cf5dc4
NagyVikt
marked this pull request as ready for review
September 1, 2026 12:28
Count array delimiters only outside quoted values when validating CodeGraph MCP sections.\n\nTested: node --test --test-reporter=dot test/setup.test.js\nTested: npx biome lint src/toolchain/index.js test/setup.test.js
NagyVikt
marked this pull request as draft
September 1, 2026 12:30
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
✅ No findings. Nothing worth an inline comment in this diff.
Provider codex · commit ddb08aa
NagyVikt
marked this pull request as ready for review
September 1, 2026 12:32
NagyVikt
marked this pull request as draft
September 1, 2026 12:37
NagyVikt
marked this pull request as ready for review
September 1, 2026 12:38
NagyVikt
deleted the
agent/codex/default-codegraph-and-opensrc-integratio-2026-08-31-17-52
branch
September 1, 2026 12:38
NagyVikt
commented
Sep 1, 2026
NagyVikt
left a comment
NagyVikt
left a comment
Collaborator
Author
There was a problem hiding this comment.
🛡️ GitGuardex code-assist
✅ No findings. Nothing worth an inline comment in this diff.
Provider codex · commit ddb08aa
NagyVikt
restored the
agent/codex/default-codegraph-and-opensrc-integratio-2026-08-31-17-52
branch
September 1, 2026 12:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan