poe-code 3.0.268 → 3.0.269

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.268",
+  "version": "3.0.269",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/agent-code-review/dist/config.js

@@ -2,6 +2,7 @@ import { lstat, mkdir, readFile, readdir, rename, stat, unlink, writeFile } from
 import { homedir } from "node:os";
 import { createConfigStore, defineScope, resolveConfigPath, resolveProjectConfigPath } from "@poe-code/poe-code-config";
 import { codeReviewConfigScope, parseCodeReviewConfigDocument, parseCodeReviewProfileDirectories } from "./config-scope.js";
+import { requireSafeDocumentSegment } from "./document-schemas.js";
 import { hasOwnErrorCode } from "./error-codes.js";
 import { resolveCodeReviewStoreDirectory } from "./review-store.js";
 const poeCoreAgentScope = defineScope("core", {
@@ -111,7 +112,7 @@ export async function resolveCodeReviewRunOptions(input, configOptions) {
         profileDirectories: parseCodeReviewProfileDirectories(inputProfileDirectories ?? configProfileDirectories),
         ...(inputProfilePath === undefined ? {} : { profilePath: inputProfilePath }),
         ...(inputPromptPath === undefined ? {} : { promptPath: inputPromptPath }),
-        ...(inputProfiles === undefined ? {} : { profiles: inputProfiles }),
+        ...(inputProfiles === undefined ? {} : { profiles: requireProfileFilters(inputProfiles) }),
         ...(inputAdditionalFeedback === undefined
             ? {}
             : { additionalFeedback: inputAdditionalFeedback })
@@ -165,6 +166,19 @@ function requireNonEmptyString(value, field) {
     }
     return normalized;
 }
+function requireProfileFilters(value) {
+    if (!Array.isArray(value)) {
+        throw new Error("profiles must be an array of safe profile names.");
+    }
+    return value.map((profile) => {
+        try {
+            return requireSafeDocumentSegment(profile, "profiles");
+        }
+        catch {
+            throw new Error("profiles must be an array of safe profile names.");
+        }
+    });
+}
 function isMissingFileError(error) {
     return hasOwnErrorCode(error, "ENOENT");
 }

package/packages/agent-code-review/dist/document-schemas.js

@@ -8,7 +8,7 @@ const CODE_REVIEW_PROMPT_ROLES = [
 ];
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/;
 const SAFE_SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
-const SAFE_GITHUB_ACTOR_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+const SAFE_GITHUB_ACTOR_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
 export function requireSafeDocumentSegment(value, field) {
     if (typeof value !== "string" ||
         value.trim() !== value ||
@@ -179,9 +179,6 @@ export function serializeCodeReviewIngestSource(source, filePath = "code-review
 function parseOptionalFrontmatter(content, filePath) {
     const match = content.match(FRONTMATTER_RE);
     if (!match) {
-        if (/^---\r?\n/.test(content)) {
-            throw new Error(`${filePath}: frontmatter is missing a closing --- delimiter.`);
-        }
         return { body: content };
     }
     try {

package/packages/agent-code-review/dist/mcp.js

@@ -11,11 +11,17 @@ import { buildCodeReviewReviewerPrompt } from "./prompt-builders.js";
 export const CODE_REVIEW_AGENT_MCP_ROLES = ["agent", "orchestrator", "subagent"];
 const inlineCommentSchema = S.Object({
     path: S.String({ description: "Repository-relative path in the PR diff." }),
-    line: S.Number({ description: "Right-side line number in the PR diff." }),
+    line: S.Number({
+        description: "Right-side line number in the PR diff.",
+        jsonType: "integer",
+        minimum: 1
+    }),
     body: S.String({ description: "Inline review comment body." })
 });
 const inlineCommentIndexSchema = S.Number({
-    description: "Zero-based merged review inline comment index."
+    description: "Zero-based merged review inline comment index.",
+    jsonType: "integer",
+    minimum: 0
 });
 const prParam = S.String({ description: "GitHub pull request URL." });
 export function parseCodeReviewAgentMcpArgs(argv) {
@@ -140,7 +146,9 @@ export function createCodeReviewAgentMcpGroup(context, dependencies = {}) {
         handler: async ({ params }) => {
             const pr = canonicalPullRequestUrl(params.pr);
             const draft = validateDraft(params);
-            const currentState = await ensureState(store, context, pr);
+            const currentState = context.role === "orchestrator"
+                ? await ensureState(store, context, pr)
+                : await requireState(store, context, pr);
             if (context.role === "orchestrator") {
                 const unfinishedProfiles = Object.values(currentState.subagents)
                     .filter(({ status }) => status === "pending" || status === "running")
@@ -342,7 +350,11 @@ export function createCodeReviewAgentMcpGroup(context, dependencies = {}) {
             pr: prParam,
             index: inlineCommentIndexSchema,
             path: S.String({ description: "Repository-relative path in the PR diff." }),
-            line: S.Number({ description: "Right-side line number in the PR diff." }),
+            line: S.Number({
+                description: "Right-side line number in the PR diff.",
+                jsonType: "integer",
+                minimum: 1
+            }),
             body: S.String({ description: "Inline review comment body." })
         }),
         handler: async ({ params }) => {

package/packages/agent-code-review/dist/review-store.js

@@ -436,8 +436,8 @@ async function withFileLock(lockPath, lockTimeoutMs, operation) {
 }
 async function isStaleLock(lockPath, lockTimeoutMs) {
     try {
-        const ownerPid = Number.parseInt((await readFile(lockPath, "utf8")).trim(), 10);
-        if (Number.isSafeInteger(ownerPid) && ownerPid > 0) {
+        const ownerPid = parseLockOwnerPid((await readFile(lockPath, "utf8")).trim());
+        if (ownerPid !== undefined) {
             return !isRunningProcess(ownerPid);
         }
         return Date.now() - (await stat(lockPath)).mtimeMs >= lockTimeoutMs;
@@ -449,6 +449,13 @@ async function isStaleLock(lockPath, lockTimeoutMs) {
         throw error;
     }
 }
+function parseLockOwnerPid(value) {
+    const processId = Number(value);
+    if (!Number.isSafeInteger(processId) || processId <= 0) {
+        return undefined;
+    }
+    return String(processId) === value ? processId : undefined;
+}
 function isRunningProcess(processId) {
     try {
         process.kill(processId, 0);