Skip to content

fix(tcfeed): surface requests that were asked and never sent a diff - #159

Merged
ralyodio merged 1 commit into
masterfrom
tcfeed-unpaired
Aug 17, 2026
Merged

fix(tcfeed): surface requests that were asked and never sent a diff#159
ralyodio merged 1 commit into
masterfrom
tcfeed-unpaired

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Two defects, both found by a maintainer rather than by us.

james-6-23/codex2api was asked in issue #525 and never sent the diff. The issue text promises "a pull request is open alongside this with the diff", so that state is a promise made and then dropped. Nothing here noticed, and nothing would have: check discovers its work by searching for open pull requests, so a repository holding a standing issue and no request is invisible to it permanently, not just for a while. The maintainer had to ask where the diff had got to.

check now also lists those repositories. It prints them before the no open requests early return, because a repository that was asked and never sent a diff is precisely the case where there is no pull request to report — the old order would have said "no open requests" and nothing about the promise outstanding.

Named, not repaired. tcfeed pr <repo> already finishes the pair deliberately, and prTarget carries the standing issue through so the new request links back to it. Opening a request against somebody's repository should stay something a person types, not a side effect of asking for status.

The second one is smaller and worse. The issue said:

Two files under .github/, a pinned @profullstack/threatcrush@…

openPr was cut back to the workflow alone in #155 when the converter went away, but issueBody was not, so every repository asked after that point was told "two files" and then shown a one-file diff. codex2api was asked on that sentence. Both now read the count off a single INSTALLS list, so the question and the answer cannot disagree about how big the change is.

Verification

  • Typechecked against a pristine master copy of the same file: identical error set (nine classes, all missing @types/node in a fresh worktree), so nothing new.
  • Positive and negative control on the detection, over all 40 open issues on the account: with head=ralyodio:threatcrush-scan it reports 0 unpaired (correct — codex2api was repaired by hand first); with a branch name that exists nowhere it reports 40. So it distinguishes present from absent rather than always returning empty.
  • tcfeed check runs end to end and prints no orphan block, which is the correct output today.
  • tcfeed pr <repo> --dry-run renders the issue as One file under .github/ against a one-file diff.

Prettier is deliberately not run: it is not in scripts and not in CI, and running it reformatted 977 unrelated lines.

The issue promises "a pull request is open alongside this with the diff".
When that second half does not happen, nothing notices: `check` discovers
its work by searching for open pull requests, so a repository holding a
standing issue and no request is invisible to it permanently.

james-6-23/codex2api sat in that state until the maintainer asked where the
diff was, which is the wrong person to be running the check. `check` now
also lists the repositories that were asked and never shown a diff, before
the "no open requests" early return, since that is exactly the case where
there is no pull request to report.

Named, not repaired. `tcfeed pr <repo>` already finishes the pair on
purpose, carrying the standing issue through so the request links back to
it, and opening a request against somebody's repository should stay
something typed rather than a side effect of asking for status.

Also: the issue said "Two files under `.github/`" while openPr had been cut
back to the workflow alone, so codex2api was asked on that sentence and then
shown a one-file diff. Both now read the count off one INSTALLS list, so the
question and the answer cannot disagree about the size of the change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

63 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 52 | LOW: 7

Severity Rule Location
HIGH secret-aws-access-key prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
HIGH sh-eval-expansion .githooks/pre-commit:26
HIGH sh-remote-script-execution apps/web/public/install.sh:272
HIGH sh-remote-script-execution apps/web/public/install.sh:320
MEDIUM insecure-temp-file .githooks/commit-msg:16
MEDIUM insecure-temp-file .githooks/post-commit:20
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/init.ts:70
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/init.ts:79
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/service.ts:92
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:31
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:33
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:34
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:35
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:36
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:43
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:49
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:56
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:63
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:82
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:84
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:85
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:93
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:98
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:105
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:112
MEDIUM js-shell-exec-interpolation apps/cli/src/index.ts:425
MEDIUM js-unescaped-html-sink apps/web/src/app/about/page.tsx:180
MEDIUM js-unescaped-html-sink apps/web/src/app/about/page.tsx:184
MEDIUM js-open-redirect apps/web/src/app/auth/login/page.tsx:50
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:125
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:153
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:157
MEDIUM js-unescaped-html-sink apps/web/src/app/get-whitepaper/page.tsx:346
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:211
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:215
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:219
MEDIUM js-unescaped-html-sink apps/web/src/app/page.tsx:120
MEDIUM js-unescaped-html-sink apps/web/src/app/store/[slug]/page.tsx:86
MEDIUM js-open-redirect apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM manifest-install-lifecycle-script package.json:24
MEDIUM js-uninitialized-buffer packages/scan/src/node-rules.ts:456
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/apt.ts:154
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/apt.ts:160
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/apt.ts:208
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/apt.ts:313
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/aur.ts:256
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/chocolatey.ts:264
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/chocolatey.ts:288
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/rpm.ts:201
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/rpm.ts:261

…and 13 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 6c11763 into master Aug 17, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant