Skip to content

fix: keep session inspection read-only - #21

Merged
Boulea7 merged 16 commits into
pr/issue5-14-runtime-safety-closurefrom
pr/issue5-15-session-readonly-closure
Apr 12, 2026
Merged

Boulea7 merged 16 commits into
pr/issue5-14-runtime-safety-closurefrom
pr/issue5-15-session-readonly-closure

Conversation

@Boulea7

@Boulea7 Boulea7 commented Apr 10, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • follows fix: close runtime safety seams #20 with a narrow session-inspection closure for issue5 closeout
  • makes cam session status and cam session load truly read-only by avoiding implicit durable-memory layout creation during inspection
  • adds source and compiled regression coverage so uninitialized projects keep returning continuity inspection payloads without writing MEMORY.md, ARCHIVE.md, or retrieval sidecars

Included

  • session command bootstrap split so save/refresh/clear/open keep the writable runtime path while status/load use a read-only runtime bootstrap
  • new CLI regression in test/session-command.test.ts for uninitialized-project status/load behavior
  • new compiled smoke coverage in test/dist-cli-smoke.test.ts for the same read-only session inspection contract

Excluded

  • no cam init idempotency or --force redesign yet
  • no Vitest .worktrees/** isolation changes yet
  • no tarball MCP smoke or docs/help parity sweep yet

Verification

  • pnpm exec vitest run test/session-command.test.ts
  • pnpm lint
  • pnpm build
  • pnpm exec vitest run test/dist-cli-smoke.test.ts -t "keeps session inspection read-only"

Stack Notes

  • branch: pr/issue5-15-session-readonly-closure
  • base: pr/issue5-14-runtime-safety-closure
  • head commit: 046a1a7
  • backup refs created before implementation:
    • backup/2026-04-10-pr15-start-pr14-20260410-234202
    • backup-tag/2026-04-10-pr15-start-pr14-20260410-234202

Review Order

Summary by Sourcery

Ensure session inspection commands operate in a read-only mode and add regression coverage for compiled and source CLIs.

Bug Fixes:

  • Prevent cam session status and cam session load from implicitly creating durable memory layouts during inspection, keeping uninitialized projects read-only.

Enhancements:

  • Split session runtime initialization so write operations use a full writable runtime while read-only inspection uses a runtime that skips memory layout creation.

Tests:

  • Add regression tests to verify session status and session load remain read-only for uninitialized projects in the source CLI.
  • Add compiled CLI smoke test to ensure session inspection does not create memory layouts or related files.

Summary by cubic

Keeps session inspection read-only and tightens runtime safety across init, integrations, and extractor. Adds an explicit, idempotent init with --force, and hardens --cwd handling.

  • Bug Fixes
    • Route session status/load through a read-only runtime (ensureMemoryLayout: false); add source and compiled CLI tests to confirm no memory layout creation and temporary continuity.
    • Make cam init explicit and idempotent: --force overwrites; by default keep valid project/local configs, ignore invalid global/managed configs, and don’t create memory layout during init.
    • Fail closed on invalid --cwd for integrations/hooks/skills (empty/whitespace/missing); mcp doctor resolves and validates --cwd; add dist and tarball smoke coverage.
    • Preserve issue-tracker memories by using host- and repo-aware keys; prevent collapsing cross-host or same-host tickets with different IDs.

Written for commit 076eccb. Summary will update on new commits.

@coderabbitai

coderabbitai Bot commented Apr 10, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 02206350-22a7-4e94-a77d-967255ede703

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch pr/issue5-15-session-readonly-closure

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@sourcery-ai

sourcery-ai Bot commented Apr 10, 2026 •

Copy link
Copy Markdown

Reviewer's Guide

Makes session inspection commands (cam session status and cam session load) truly read-only by avoiding implicit memory layout creation, and adds regression coverage at both source and compiled CLI layers to ensure uninitialized projects do not create memory artifacts during inspection.

Sequence diagram for writable vs read-only session runtime bootstrap

sequenceDiagram
  actor User
  participant CLI as CamCLI
  participant SessionCmd as runSession
  participant Runtime as buildRuntimeContext
  participant Store as SessionContinuityStore

  rect rgb(230,250,230)
    User->>CLI: cam session save|refresh
    CLI->>SessionCmd: runSession(action=save|refresh)
    SessionCmd->>Runtime: buildRuntimeContext(cwd)
    Runtime-->>SessionCmd: runtime (writable, ensureMemoryLayout=true)
    SessionCmd->>SessionCmd: prepareSessionPersistenceRequest(runtime, action, scope)
    SessionCmd->>Store: write session continuity
    Store-->>SessionCmd: persistence result
    SessionCmd-->>CLI: output message
    CLI-->>User: show save|refresh result
  end

  rect rgb(230,230,250)
    User->>CLI: cam session clear
    CLI->>SessionCmd: runSession(action=clear)
    SessionCmd->>Runtime: buildRuntimeContext(cwd)
    Runtime-->>SessionCmd: runtime (writable, ensureMemoryLayout=true)
    SessionCmd->>Store: clear(scope)
    Store-->>SessionCmd: cleared boolean
    SessionCmd-->>CLI: output cleared result
    CLI-->>User: show clear result
  end

  rect rgb(250,230,230)
    User->>CLI: cam session open
    CLI->>SessionCmd: runSession(action=open)
    SessionCmd->>Runtime: buildRuntimeContext(cwd)
    Runtime-->>SessionCmd: runtime (writable, ensureMemoryLayout=true)
    SessionCmd->>Store: ensureLocalLayout()
    Store-->>SessionCmd: layout ensured
    SessionCmd->>CLI: localDir path
    CLI-->>User: open continuity directory
  end

  rect rgb(250,250,200)
    User->>CLI: cam session status|load
    CLI->>SessionCmd: runSession(action=status|load)
    Note over SessionCmd: No earlier writable runtime bootstrap
    SessionCmd->>Runtime: buildRuntimeContext(cwd, {}, { ensureMemoryLayout: false })
    Runtime-->>SessionCmd: runtime (readOnly, no layout creation)
    SessionCmd->>SessionCmd: loadSessionInspectionView(runtime)
    SessionCmd-->>CLI: inspection payload
    CLI-->>User: show status or apply load
  end
Loading

Class diagram for runtime context and read-only session inspection

classDiagram
  class RuntimeContext {
    +SessionContinuityStore sessionContinuityStore
  }

  class SessionContinuityStore {
    +paths paths
    +clear(scope) Promise~boolean~
    +ensureLocalLayout() Promise~void~
  }

  class SessionContinuityPaths {
    +string localDir
  }

  class BuildRuntimeContextOptions {
    +boolean ensureMemoryLayout
  }

  class BuildRuntimeContextConfig {
  }

  class BuildRuntimeContext {
    +buildRuntimeContext(cwd, config, options) Promise~RuntimeContext~
  }

  class SessionCommand {
    +runSession(action, options) Promise~string~
    -loadSessionInspectionView(runtime) Promise~string~
  }

  RuntimeContext --> SessionContinuityStore
  SessionContinuityStore --> SessionContinuityPaths : uses
  BuildRuntimeContext --> RuntimeContext : creates

  SessionCommand --> RuntimeContext : uses
  SessionCommand ..> BuildRuntimeContext : calls

  BuildRuntimeContextOptions <.. BuildRuntimeContext : parameter
  BuildRuntimeContextConfig <.. BuildRuntimeContext : parameter

  note for SessionCommand "Writable actions: save, refresh, clear, open call buildRuntimeContext(cwd) with default ensureMemoryLayout=true"
  note for SessionCommand "Read-only actions: status, load call buildRuntimeContext(cwd, {}, { ensureMemoryLayout: false })"
Loading

File-Level Changes

Change Details Files
Make session inspection use a read-only runtime that does not create durable memory layout when running session status/load.
  • Delay building the runtime context until after the action is known in runSession.
  • Use a full, writable runtime only for save, refresh, clear, and open session actions.
  • Introduce a read-only runtime construction for inspection that passes ensureMemoryLayout: false to buildRuntimeContext before loading the session inspection view.
  • Ensure open still calls ensureLocalLayout on the writable runtime before opening the continuity directory.
src/lib/commands/session.ts
Add regression tests to guarantee session status and session load remain read-only for uninitialized projects and from the compiled CLI entrypoint.
  • Introduce a shared pathExists helper in both session command and dist CLI smoke tests to assert that auto memory directories are not created.
  • Add a new runSession-level test that configures autoMemoryDirectory for an uninitialized repo and asserts status/load JSON shape while verifying no memory root directory is created.
  • Add a compiled CLI smoke test that exercises session status and session load against an uninitialized project with autoMemoryDirectory configured and asserts the same JSON inspection payload and absence of a memory root directory.
test/session-command.test.ts
test/dist-cli-smoke.test.ts

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • The pathExists helper is duplicated in both dist-cli-smoke.test.ts and session-command.test.ts; consider extracting it into a shared test utility to keep the tests DRY and consistent.
  • In runSession, buildRuntimeContext is now called multiple times with different options depending on the action; consider centralizing this branching (e.g., a small helper or a lookup by action) to avoid repeated logic and make the read-only vs. writable behavior easier to reason about.
  • The JSON toMatchObject expectations for status and load are identical in both new tests; factoring this expected payload into a reusable helper would simplify the tests and reduce the chance of the assertions drifting apart.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- The `pathExists` helper is duplicated in both `dist-cli-smoke.test.ts` and `session-command.test.ts`; consider extracting it into a shared test utility to keep the tests DRY and consistent.
- In `runSession`, `buildRuntimeContext` is now called multiple times with different options depending on the action; consider centralizing this branching (e.g., a small helper or a lookup by action) to avoid repeated logic and make the read-only vs. writable behavior easier to reason about.
- The JSON `toMatchObject` expectations for `status` and `load` are identical in both new tests; factoring this expected payload into a reusable helper would simplify the tests and reduce the chance of the assertions drifting apart.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 3 files

@Boulea7
Boulea7 force-pushed the pr/issue5-14-runtime-safety-closure branch from b2ecfc9 to 9c539a3 Compare April 11, 2026 12:56
@Boulea7
Boulea7 force-pushed the pr/issue5-15-session-readonly-closure branch from 046a1a7 to 9aa9e07 Compare April 11, 2026 12:56
@Boulea7
Boulea7 force-pushed the pr/issue5-15-session-readonly-closure branch from 9aa9e07 to cc2ea2f Compare April 11, 2026 13:28
@Boulea7
Boulea7 force-pushed the pr/issue5-14-runtime-safety-closure branch from 9c539a3 to fad8b57 Compare April 11, 2026 13:30
@Boulea7
Boulea7 merged commit 50f6bc2 into pr/issue5-14-runtime-safety-closure Apr 12, 2026
3 of 4 checks passed
@Boulea7
Boulea7 deleted the pr/issue5-15-session-readonly-closure branch April 12, 2026 11:59
Boulea7 added a commit that referenced this pull request Apr 12, 2026
…sure

issue5 keep session inspection read-only
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant