Skip to content

feat: add queue for task deletion cleanup#1532

Merged
getlarge merged 10 commits into
mainfrom
codex-async-task-delete
Jul 3, 2026
Merged

feat: add queue for task deletion cleanup#1532
getlarge merged 10 commits into
mainfrom
codex-async-task-delete

Conversation

@legreffier

@legreffier legreffier Bot commented Jun 30, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

  • queues DELETE /tasks through a DBOS cleanup workflow and returns 202 with workflowId, accepted, and skipped
  • keeps default deletion safe while using force: true plus reason for protected/sealed terminal tasks
  • removes task dependencies during async cleanup: correlation seals, runtime-session child links, Keto relations, and artifact/session objects via bulk deletes
  • regenerates OpenAPI, TypeScript API client, Go API client, SDK types, and updates console copy for queued deletion

Refs #1484

Validation

  • pnpm exec vitest run --root libs/task-service src/task.service.test.ts
  • pnpm exec vitest run --config apps/rest-api/vitest.config.ts apps/rest-api/__tests__/task-orphan-sweeper.test.ts
  • pnpm exec vitest run --config libs/sdk/vitest.config.ts libs/sdk/__tests__/agent.test.ts
  • pnpm --filter @moltnet/rest-api typecheck
  • pnpm --filter @moltnet/api-client build
  • pnpm exec nx run @moltnet/console:typecheck
  • pnpm exec nx run @moltnet/task-service:typecheck --skipNxCache
  • pnpm exec nx run @themoltnet/sdk:typecheck --skipNxCache
  • go test github.com/getlarge/themoltnet/libs/moltnet-api-client/...
  • git diff --check

Not run: rest-api e2e suite, because the e2e Docker stack was not started in this worktree.

legreffier Bot added 2 commits June 30, 2026 16:19
@legreffier
feat(tasks): queue batch deletion cleanup
14e0bde 
MoltNet-Diary: 48c3467f-b591-4077-baa7-5cbf14792ec0
Task-Group: async-task-delete
Task-Family: feature
@legreffier
chore(api): regenerate async task deletion clients
51bef4a 
MoltNet-Diary: 3f0d9887-2a98-46e9-9e9e-7bdfb2f032ad
Task-Group: async-task-delete
@github-actions

github-actions Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ CLI go.mod matches internal Go module releases

apps/moltnet-cli/go.mod is aligned with the versions tracked in .release-please-manifest.json.

@github-actions

github-actions Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

🚨 Dependency Audit — Vulnerabilities found

Full report 
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Incomplete fix for CVE-2023-48223: JWT       │
│                     │ Algorithm Confusion via Whitespace-Prefixed RSA Public │
│                     │ Key                                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mvf2-f6gm-w987      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Cache Confusion via cacheKeyBuilder          │
│                     │ Collisions Can Return Claims From a Different Token    │
│                     │ (Identity/Authorization Mixup)                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=0.0.1 <6.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-rp9m-7r4c-75qg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ Arbitrary code execution in protobufjs                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.0.1                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xq3m-2v4x-88gg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: JWT auth bypass due to empty HMAC secret     │
│                     │ accepted by async key resolver                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.2.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-gmvf-9v4p-v8jc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-jwt accepts unknown `crit` header extensions (RFC │
│                     │ 7515 violation)                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm7r-c7qw-ghp6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code injection through bytes field        │
│                     │ defaults in generated toObject code                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-66ff-xgx4-vchm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code generation gadget after prototype    │
│                     │ pollution                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-75px-5xx7-5xc7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Process-wide denial of service through    │
│                     │ unsafe option paths                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jvwf-75h9-cwgg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Denial of service through unbounded       │
│                     │ protobuf recursion                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-685m-2w69-288q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobufjs: Denial of service through unbounded Any    │
│                     │ expansion during JSON conversion                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.4.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.4.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-wcpc-wj8m-hjx6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to TLS certificate validation bypass │
│                     │ via dropped requestTls in SOCKS5 ProxyAgent            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vmh5-mc38-953g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to TLS certificate validation bypass │
│                     │ via dropped requestTls in SOCKS5 ProxyAgent            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.23.0 <7.28.0                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vmh5-mc38-953g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via cumulative fragment bypass                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-38rv-x7px-6hhq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via fragment count bypass                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vxpw-j846-p89q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via fragment count bypass                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vxpw-j846-p89q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to cross-origin request routing via  │
│                     │ SOCKS5 proxy pool reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.23.0 <7.28.0                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm92-r4w5-c3mj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt has a ReDoS when using RegExp in allowed*     │
│                     │ leading to CPU exhaustion during token verification    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0 <=6.2.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-cjw9-ghj4-fwxf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt: Stateful RegExp (/g or /y) causes            │
│                     │ non-deterministic allowed-claim validation (logical    │
│                     │ DoS)                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <6.2.1                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-3j8v-cgw4-2g6q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ ip-address has XSS in Address6 HTML-emitting methods   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ ip-address                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=10.1.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>express-rate- │
│                     │ limit>ip-address                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v2v4-37r5-5v8g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Denial of service from crafted field      │
│                     │ names in generated code                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2pr8-phx7-x9h3      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Prototype injection in generated message  │
│                     │ constructors                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fx83-v9x8-x52w      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs has overlong UTF-8 decoding                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q6x5-8v7m-xcrf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs: Denial of Service via unbounded recursive  │
│                     │ JSON descriptor expansion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jggg-4jg4-v7c6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ uuid: Missing buffer bounds check in v3/v5/v6 when buf │
│                     │ is provided                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ uuid                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <11.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=11.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>mqemitter-      │
│                     │ redis>hyperid>uuid                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-w5hq-g745-h8pq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs : Schema-derived names can shadow           │
│                     │ runtime-significant properties                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.5.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.6.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f38q-mgvj-vph7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ OpenTelemetry Core: Unbounded memory allocation in W3C │
│                     │ Baggage propagation                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @opentelemetry/core                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <2.8.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=2.8.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/core                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-8988-4f7v-96qf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to HTTP header injection via         │
│                     │ Set-Cookie percent-decoding                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p88m-4jfj-68fv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to HTTP header injection via         │
│                     │ Set-Cookie percent-decoding                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p88m-4jfj-68fv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to cross-user information disclosure │
│                     │ via shared cache whitespace bypass                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pr7r-676h-xcf6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to cross-user information disclosure │
│                     │ via shared cache whitespace bypass                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pr7r-676h-xcf6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ Elliptic Uses a Cryptographic Primitive with a Risky   │
│                     │ Implementation                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ elliptic                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.6.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ libs__auth>get-jwks>jwk-to-pem>elliptic                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-848j-6mx2-7j84      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to HTTP response queue poisoning via │
│                     │ keep-alive socket reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-35p6-xmwp-9g52      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to HTTP response queue poisoning via │
│                     │ keep-alive socket reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-35p6-xmwp-9g52      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to Set-Cookie SameSite attribute     │
│                     │ downgrade via permissive substring matching            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-g8m3-5g58-fq7m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to Set-Cookie SameSite attribute     │
│                     │ downgrade via permissive substring matching            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-g8m3-5g58-fq7m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
35 vulnerabilities found
Severity: 5 low | 14 moderate | 12 high | 4 critical

@github-actions

github-actions Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Knip — Unused code or dependencies found

Run pnpm run knip locally to see details, or pnpm run knip:fix to auto-fix some of them.

Full report 
�[93m�[4mUnused files�[24m�[39m (42)
.agents/skills/monitor-ci/scripts/ci-poll-decide.mjs                                       
.agents/skills/monitor-ci/scripts/ci-state-update.mjs                                      
apps/agent-daemon/src/lib/sandbox.ts                                                       
apps/console/e2e/seed-diary-browser.ts                                                     
apps/landing/src/hooks/useFeedSSE.ts                                                       
apps/mcp-host/server.mjs                                                                   
apps/mcp-host/src/sandbox.ts                                                               
apps/mcp-server/src/schemas/index.ts                                                       
apps/rest-api/src/migrate.ts                                                               
apps/rest-api/src/sse/public-feed-poller.ts                                                
apps/rest-api/src/sse/sse-writer.ts                                                        
apps/rest-api/src/typebox-schema-id.d.ts                                                   
docs/.vitepress/env.d.ts                                                                   
evals/moltnet-practices/auth-middleware-early-return/fixtures/auth-plugin.ts               
evals/moltnet-practices/auth-middleware-early-return/fixtures/team-resolver.ts             
evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/sdk.gen.ts                    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/consolidate-workflow.ts    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/diary-entry.repository.ts  
evals/moltnet-practices/rest-error-boundary/fixtures/pack-routes.ts                        
evals/moltnet-practices/rest-error-boundary/fixtures/verification-routes.ts                
evals/moltnet-practices/webhook-auth-status-code/fixtures/hooks.ts                         
examples/diary-create.ts                                                                   
examples/diary-search.ts                                                                   
examples/register.ts                                                                       
examples/sign-entry.ts                                                                     
test-fixtures/generate-ssh-vectors.mjs                                                     
test-fixtures/generate-x25519-vectors.mjs                                                  
tools/db/backfill-content-hashes.ts                                                        
tools/db/backfill-diary-team-links.ts                                                      
tools/db/backfill-keto-subject-set.ts                                                      
tools/db/backfill-personal-teams.ts                                                        
tools/db/backfill-team-relations-plural.ts                                                 
tools/db/cleanup-legacy-diary-tuples.ts                                                    
tools/docker-build.mjs                                                                     
tools/generators/split-tsconfigs/index.ts                                                  
tools/generators/split-tsconfigs/schema.d.ts                                               
tools/release/docker-preversion.mjs                                                        
tools/src/release/github-action-publisher.ts                                               
tools/src/release/go-module-publisher.cli.ts                                               
tools/src/tasks/api.ts                                                                     
tools/src/tasks/scenario.ts                                                                
tools/src/tasks/seed-judge-fixture.ts                                                      
�[93m�[4mUnused dependencies�[24m�[39m (53)
@earendil-works/gondolin                     apps/agent-daemon/package.json:38:6        
@opentelemetry/instrumentation               apps/agent-daemon/package.json:43:6        
@opentelemetry/instrumentation-dns           apps/agent-daemon/package.json:44:6        
@opentelemetry/instrumentation-http          apps/agent-daemon/package.json:45:6        
@opentelemetry/instrumentation-net           apps/agent-daemon/package.json:46:6        
@opentelemetry/instrumentation-pg            apps/agent-daemon/package.json:47:6        
@opentelemetry/instrumentation-pino          apps/agent-daemon/package.json:48:6        
@opentelemetry/instrumentation-undici        apps/agent-daemon/package.json:49:6        
pino-pretty                                  apps/agent-daemon/package.json:58:6        
@moltnet/models                              apps/console/package.json:11:6             
@moltnet/entry-explore-mcp-app               apps/mcp-server/package.json:30:6          
@themoltnet/design-system                    apps/mcp-server/package.json:34:6          
@fastify/otel                                apps/mcp-server/package.json:36:6          
@opentelemetry/exporter-metrics-otlp-proto   apps/mcp-server/package.json:38:6          
@opentelemetry/exporter-trace-otlp-proto     apps/mcp-server/package.json:39:6          
@opentelemetry/instrumentation               apps/mcp-server/package.json:40:6          
@opentelemetry/instrumentation-dns           apps/mcp-server/package.json:41:6          
@opentelemetry/instrumentation-http          apps/mcp-server/package.json:42:6          
@opentelemetry/instrumentation-net           apps/mcp-server/package.json:43:6          
@opentelemetry/instrumentation-pino          apps/mcp-server/package.json:44:6          
@opentelemetry/instrumentation-pg            apps/mcp-server/package.json:45:6          
@opentelemetry/instrumentation-runtime-node  apps/mcp-server/package.json:46:6          
@opentelemetry/instrumentation-undici        apps/mcp-server/package.json:47:6          
@opentelemetry/resources                     apps/mcp-server/package.json:48:6          
@opentelemetry/sdk-metrics                   apps/mcp-server/package.json:49:6          
@opentelemetry/sdk-trace-base                apps/mcp-server/package.json:50:6          
@opentelemetry/sdk-trace-node                apps/mcp-server/package.json:51:6          
@opentelemetry/semantic-conventions          apps/mcp-server/package.json:52:6          
pino                                         apps/mcp-server/package.json:56:6          
pino-opentelemetry-transport                 apps/mcp-server/package.json:57:6          
thread-stream                                apps/mcp-server/package.json:58:6          
@huggingface/transformers                    apps/rest-api/package.json:33:6            
@opentelemetry/exporter-metrics-otlp-proto   apps/rest-api/package.json:50:6            
@opentelemetry/instrumentation               apps/rest-api/package.json:52:6            
@opentelemetry/resources                     apps/rest-api/package.json:60:6            
@opentelemetry/sdk-metrics                   apps/rest-api/package.json:61:6            
@opentelemetry/sdk-trace-base                apps/rest-api/package.json:62:6            
@opentelemetry/sdk-trace-node                apps/rest-api/package.json:63:6            
@opentelemetry/semantic-conventions          apps/rest-api/package.json:64:6            
multiformats                                 apps/rest-api/package.json:71:6            
pino-pretty                                  apps/rest-api/package.json:74:6            
thread-stream                                apps/rest-api/package.json:75:6            
@noble/hashes                                libs/context-pack-service/package.json:19:6
typebox                                      libs/sdk/package.json:44:6                 
tslib                                        package.json:149:6                         
@earendil-works/pi-ai                        tools/package.json:22:6                    
@earendil-works/pi-coding-agent              tools/package.json:23:6                    
@moltnet/auth                                tools/package.json:25:6                    
@moltnet/models                              tools/package.json:32:6                    
@themoltnet/agent-runtime                    tools/package.json:36:6                    
@themoltnet/pi-extension                     tools/package.json:38:6                    
drizzle-orm                                  tools/package.json:41:6                    
fastq                                        tools/package.json:42:6                    
�[93m�[4mUnused devDependencies�[24m�[39m (21)
@moltnet/database           apps/console/package.json:23:6              
@moltnet/bootstrap          apps/mcp-server/package.json:61:6           
@moltnet/database           apps/mcp-server/package.json:62:6           
drizzle-orm                 apps/mcp-server/package.json:65:6           
pino-pretty                 apps/mcp-server/package.json:66:6           
vitest                      libs/bootstrap/package.json:24:6            
@moltnet/crypto-service     libs/context-distill/package.json:17:6      
@moltnet/database           libs/context-distill/package.json:18:6      
@testcontainers/postgresql  libs/context-distill/package.json:19:6      
drizzle-orm                 libs/context-distill/package.json:20:6      
pg                          libs/context-distill/package.json:21:6      
@types/pg                   libs/context-distill/package.json:22:6      
testcontainers              libs/diary-service/package.json:29:6        
@testing-library/react      libs/entry-explore-mcp-app/package.json:30:6
vitest                      libs/mcp-test-harness/package.json:22:6     
@nx/devkit                  package.json:74:6                           
@swc/helpers                package.json:86:6                           
husky                       package.json:96:6                           
lint-staged                 package.json:101:6                          
vite-plugin-dts             package.json:109:6                          
@types/figlet               tools/package.json:51:6                     
�[93m�[4mReferenced optional peerDependencies�[24m�[39m (1)
ink  libs/design-system/package.json
�[93m�[4mUnlisted dependencies�[24m�[39m (2)
@moltnet/database  evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/governance.e2e.test.ts:19:46
pg                 libs/diary-service/__tests__/diary-service.dbos.integration.test.ts:38:27                
�[93m�[4mUnlisted binaries�[24m�[39m (7)
python3                                             .github/workflows/ci.yml     
clawhub                                             .github/workflows/release.yml
gofmt                                               .lintstagedrc.mjs            
go                                                  package.json                 
gofmt                                               package.json                 
packages/openclaw-skill/scripts/publish-clawhub.sh  package.json                 
packages/openclaw-skill/scripts/package.sh          package.json                 
�[93m�[4mUnused exports�[24m�[39m (108)
COMMON_REQUIRED_FLAGS                                       apps/agent-daemon/src/lib/help.ts:3:14                      
COMMON_OPTIONAL_FLAGS                                       apps/agent-daemon/src/lib/help.ts:11:14                     
getDaemonRuntimeContext                           function  apps/agent-daemon/src/lib/runtime-context.ts:24:17          
buildDaemonSlotId                                 function  apps/agent-daemon/src/lib/task-execution-plan.ts:97:17      
ENTRY_TYPE_LABELS                                           apps/console/src/diaries/utils.ts:14:3                      
ENTRY_TYPES                                                 apps/console/src/diaries/utils.ts:15:3                      
estimateTokenCount                                          apps/console/src/diaries/utils.ts:16:3                      
formatDateTime                                              apps/console/src/diaries/utils.ts:17:3                      
ENTRY_TYPE_OPTIONS                                          apps/console/src/diaries/utils.ts:21:14                     
getEntryTypeQuery                                 function  apps/console/src/diaries/utils.ts:29:17                     
MOBILE_BREAKPOINT                                           apps/console/src/hooks/useIsMobile.ts:3:14                  
TABLET_BREAKPOINT                                           apps/console/src/hooks/useIsMobile.ts:4:14                  
groupTasksByLane                                            apps/console/src/tasks/status.ts:25:3                       
statusToLane                                                apps/console/src/tasks/status.ts:26:3                       
TASK_LANES                                                  apps/console/src/tasks/status.ts:27:3                       
consoleCorrelationUrl                             function  apps/issue-lifecycle/src/status-comment.ts:36:17            
consoleAttemptUrl                                 function  apps/issue-lifecycle/src/status-comment.ts:48:17            
outputState                                       function  apps/issue-lifecycle/src/test-fakes.ts:41:17                
API_BASE_URL                                                apps/landing/src/api.ts:16:14                               
handleDiaryTags                                   function  apps/mcp-server/src/diary-tools.ts:315:23                   
handleGrantCreate                                 function  apps/mcp-server/src/grant-tools.ts:38:23                    
handleGrantRevoke                                 function  apps/mcp-server/src/grant-tools.ts:70:23                    
handleGrantList                                   function  apps/mcp-server/src/grant-tools.ts:102:23                   
handlePacksUpdate                                 function  apps/mcp-server/src/pack-tools.ts:319:23                    
handleRenderedPacksUpdate                         function  apps/mcp-server/src/pack-tools.ts:409:23                    
handlePacksDiff                                   function  apps/mcp-server/src/pack-tools.ts:511:23                    
EntryMapZoneSearchSchema                                    apps/mcp-server/src/schemas/entry-explore-schemas.ts:9:14   
EntryMapZoneProvenanceSchema                                apps/mcp-server/src/schemas/entry-explore-schemas.ts:24:14  
EntryMapZoneSchema                                          apps/mcp-server/src/schemas/entry-explore-schemas.ts:47:14  
EntryMapDataSchema                                          apps/mcp-server/src/schemas/entry-explore-schemas.ts:88:14  
CustomPackEntrySelectionSchema                              apps/mcp-server/src/schemas/pack-schemas.ts:107:14          
handleTasksContinue                               function  apps/mcp-server/src/task-tools.ts:177:23                    
handleTeamsList                                   function  apps/mcp-server/src/team-tools.ts:62:23                     
handleTeamMembersList                             function  apps/mcp-server/src/team-tools.ts:84:23                     
handleTeamsCreate                                 function  apps/mcp-server/src/team-tools.ts:109:23                    
handleTeamsJoin                                   function  apps/mcp-server/src/team-tools.ts:132:23                    
handleTeamsDelete                                 function  apps/mcp-server/src/team-tools.ts:155:23                    
handleTeamsInviteCreate                           function  apps/mcp-server/src/team-tools.ts:178:23                    
handleTeamsInviteList                             function  apps/mcp-server/src/team-tools.ts:211:23                    
handleTeamsInviteDelete                           function  apps/mcp-server/src/team-tools.ts:236:23                    
handleTeamsMemberRemove                           function  apps/mcp-server/src/team-tools.ts:264:23                    
ServerConfigSchema                                          apps/rest-api/src/config.ts:27:14                           
DatabaseConfigSchema                                        apps/rest-api/src/config.ts:39:14                           
WebhookConfigSchema                                         apps/rest-api/src/config.ts:44:14                           
RecoveryConfigSchema                                        apps/rest-api/src/config.ts:48:14                           
OryConfigSchema                                             apps/rest-api/src/config.ts:52:14                           
ObservabilityConfigSchema                                   apps/rest-api/src/config.ts:63:14                           
RuntimeSessionStorageConfigSche…                            apps/rest-api/src/config.ts:131:14                          
TaskArtifactStorageConfigSchema                             apps/rest-api/src/config.ts:149:14                          
EmbeddingConfigSchema                                       apps/rest-api/src/config.ts:165:14                          
SecurityConfigSchema                                        apps/rest-api/src/config.ts:172:14                          
loadEmbeddingConfig                               function  apps/rest-api/src/config.ts:380:17                          
loadPackGcConfig                                  function  apps/rest-api/src/config.ts:390:17                          
loadTaskOrphanSweeperConfig                       function  apps/rest-api/src/config.ts:400:17                          
loadTaskArtifactStorageConfig                     function  apps/rest-api/src/config.ts:420:17                          
acceptsProblemJson                                          apps/rest-api/src/problems/index.ts:2:3                     
findProblemTypeByCode                                       apps/rest-api/src/problems/index.ts:9:3                     
findProblemTypeByStatus                                     apps/rest-api/src/problems/index.ts:10:3                    
getTypeUri                                                  apps/rest-api/src/problems/index.ts:11:3                    
problemTypes                                                apps/rest-api/src/problems/index.ts:13:3                    
DiaryTagCountSchema                                         apps/rest-api/src/schemas/diary.ts:58:14                    
PublicAuthorSchema                                          apps/rest-api/src/schemas/diary.ts:123:14                   
ContextPackEntrySchema                                      apps/rest-api/src/schemas/packs.ts:9:14                     
TaskTypeDescriptorSchema                                    apps/rest-api/src/schemas/tasks.ts:316:14                   
serializeRuntimeWorkspace                         function  apps/rest-api/src/services/runtime-slots.ts:171:17          
inflateRowCreator                                 function  apps/rest-api/src/utils/auth-principal.ts:142:23            
resolvePrincipal                                            apps/rest-api/src/utils/auth-principal.ts:191:10            
HumanOnboardingError              WorkflowExpor…  class     …s/rest-api/src/workflows/human-onboarding-workflow.ts:36:14
diaryTransferWorkflow             WorkflowExpor…            apps/rest-api/src/workflows/index.ts:4:3                    
TRANSFER_DECISION_EVENT           WorkflowExpor…            apps/rest-api/src/workflows/index.ts:7:3                    
HumanOnboardingError              WorkflowExpor…            apps/rest-api/src/workflows/index.ts:12:3                   
DEFAULT_WORKFLOW_TIMEOUT_MS       WorkflowExpor…            apps/rest-api/src/workflows/index.ts:49:3                   
runWorkflow                       WorkflowExpor…            apps/rest-api/src/workflows/index.ts:50:3                   
FOUNDING_ACCEPT_EVENT             WorkflowExpor…            apps/rest-api/src/workflows/index.ts:54:3                   
TeamFoundingTimeoutError          WorkflowExpor…            apps/rest-api/src/workflows/index.ts:60:3                   
teamFoundingWorkflow              WorkflowExpor…            apps/rest-api/src/workflows/index.ts:61:3                   
DEFAULT_WORKFLOW_TIMEOUT_MS       WorkflowExpor…            apps/rest-api/src/workflows/run-workflow.ts:14:14           
runWorkflow                       WorkflowExpor…  function  apps/rest-api/src/workflows/run-workflow.ts:33:23           
TeamFoundingTimeoutError          WorkflowExpor…  class     apps/rest-api/src/workflows/team-founding-workflow.ts:32:14 
DEFAULT_E2E_REST_API_URL                                    libs/bootstrap/src/e2e-harness.ts:26:14                     
DEFAULT_E2E_DATABASE_URL                                    libs/bootstrap/src/e2e-harness.ts:27:14                     
DEFAULT_E2E_HYDRA_PUBLIC_URL                                libs/bootstrap/src/e2e-harness.ts:29:14                     
DEFAULT_E2E_HYDRA_ADMIN_URL                                 libs/bootstrap/src/e2e-harness.ts:30:14                     
DEFAULT_E2E_KETO_READ_URL                                   libs/bootstrap/src/e2e-harness.ts:31:14                     
DEFAULT_E2E_KETO_WRITE_URL                                  libs/bootstrap/src/e2e-harness.ts:32:14                     
DEFAULT_E2E_KRATOS_ADMIN_URL                                libs/bootstrap/src/e2e-harness.ts:33:14                     
DEFAULT_E2E_AGENT_SCOPES                                    libs/bootstrap/src/e2e-harness.ts:34:14                     
DBOSWorkflowConflictError                                   libs/database/src/dbos.ts:154:3                             
DEFAULT_DISPATCH_TIMEOUT_SECONDS                            libs/database/src/workflows/task-workflows.ts:135:14        
DEFAULT_RUNNING_TIMEOUT_SECONDS                             libs/database/src/workflows/task-workflows.ts:139:14        
MAX_PUBLIC_CONTENT_LENGTH                                   libs/diary-service/src/diary-service.ts:51:14               
nextStepId                                        function  libs/entry-explore-mcp-app/src/state/map.ts:117:17          
DEFAULT_TASK_ARTIFACT_MAX_BYTES                             …node-red-contrib-core/src/nodes/task-artifact-utils.ts:9:14
resolveTaskId                                     function  …ode-red-contrib-core/src/nodes/task-artifact-utils.ts:26:17
resolveTeamId                                     function  …ode-red-contrib-core/src/nodes/task-artifact-utils.ts:39:17
resolveAttemptN                                   function  …ode-red-contrib-core/src/nodes/task-artifact-utils.ts:53:17
resolveOverride                                   function  libs/node-red-contrib-core/src/nodes/task-builder.ts:118:17 
abortError                                        function  libs/pi-extension/src/abort-utils.ts:9:17                   
resolveTaskScratchPath                            function  libs/pi-extension/src/runtime/task-workspace.ts:130:17      
GUEST_TASK_SKILLS_MOUNT                                     libs/pi-extension/src/vm-manager.ts:42:14                   
makeClient                                        function  packages/legreffier-cli/src/api.ts:78:17                    
formatPortIssues                                  function  packages/legreffier-cli/src/phases/portValidate.ts:213:17   
main                                              function  tools/src/release/go-artifact-publisher.cli.ts:106:23       
printGoArtifactReleasePlan                        function  tools/src/release/go-artifact-publisher.ts:531:17           
readText                                          function  tools/src/release/go-version-actions.ts:43:17               
readGoModulePath                                  function  tools/src/release/go-version-actions.ts:47:17               
resolveGoReleaseValidationRoots                   function  tools/src/release/go-version-actions.ts:200:17              
default                                           class     tools/src/release/go-version-actions.ts:731:22              
�[93m�[4mUnused exported types�[24m�[39m (64)
PiAgentDirSource                               type       apps/agent-daemon/src/lib/pi-agent-dir.ts:4:13                
MailRecord                                     interface  apps/console/e2e/helpers/mailslurper.ts:3:18                  
GroupedTasks                                   type       apps/console/src/tasks/status.ts:24:8                         
TaskLane                                       type       apps/console/src/tasks/status.ts:28:8                         
TaskLaneId                                     type       apps/console/src/tasks/status.ts:29:8                         
UiResourceData                                 interface  apps/mcp-host/src/implementation.ts:25:18                     
EntryMapZoneSearch                             type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:22:13    
EntryMapZone                                   type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:86:13    
CorsPluginOptions                              interface  apps/rest-api/src/plugins/cors.ts:11:18                       
RateLimitPluginOptions                         interface  apps/rest-api/src/plugins/rate-limit.ts:19:18                 
ProblemType                                    type       apps/rest-api/src/problems/index.ts:12:8                      
AgentPrincipal                                 type       apps/rest-api/src/schemas/principal.ts:37:8                   
HumanPrincipal                                 type       apps/rest-api/src/schemas/principal.ts:39:8                   
PrincipalIdentity                              type       apps/rest-api/src/schemas/principal.ts:41:8                   
RuntimeSlotSubject                             interface  apps/rest-api/src/services/runtime-slots.ts:33:18             
CreateTaskInput                                type       apps/rest-api/src/services/task.service.ts:2:8                
AuthContext                                    type       apps/rest-api/src/types.ts:14:3                               
RelationshipReader                             type       apps/rest-api/src/types.ts:16:3                               
RelationshipWriter                             type       apps/rest-api/src/types.ts:17:3                               
RuntimeSessionStorage                          type       apps/rest-api/src/types.ts:45:15                              
TaskArtifactStorage                            type       apps/rest-api/src/types.ts:46:15                              
DiaryTransferDeps              WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:2:8                      
DiaryTransferResult            WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:3:8                      
TransferDecision               WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:8:8                      
HumanOnboardingDeps            WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:11:8                     
HumanOnboardingResult          WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:13:8                     
LegreffierOnboardingDeps       WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:24:8                     
MaintenanceDeps                WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:33:8                     
TaskDeletionWorkflowInput      WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:36:8                     
TaskDeletionWorkflowResult     WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:37:8                     
RegistrationDeps               WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:41:8                     
RegistrationResult             WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:42:8                     
RunWorkflowOptions             WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:51:8                     
FoundingMember                 WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:55:8                     
TeamFoundingDeps               WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:58:8                     
TeamFoundingResult             WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:59:8                     
RunWorkflowOptions             WorkflowExpor…  interface  apps/rest-api/src/workflows/run-workflow.ts:21:18             
AdoptionState                                  interface  docs/.vitepress/theme/auth/useAdoption.ts:38:18               
AdoptionStageKey                               type       docs/.vitepress/theme/auth/useAdoption.ts:285:13              
AdoptionStage                                  interface  docs/.vitepress/theme/auth/useAdoption.ts:293:18              
DocsTeam                                       interface  docs/.vitepress/theme/auth/useTeamSelection.ts:9:18           
SessionResolverLogger                          interface  libs/auth/src/session-resolver.ts:24:18                       
GroupCreator                                   interface  libs/database/src/repositories/group.repository.ts:16:18      
RuntimeWorkspaceKind                           type       …bs/database/src/repositories/runtime-slot.repository.ts:15:13
EntriesListArgs                                interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:22:18    
EntriesSearchArgs                              interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:32:18    
DiaryTagsArgs                                  interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:44:18    
EntriesGetArgs                                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:51:18    
PacksCreateArgs                                interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:57:18    
PacksUpdateArgs                                interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:65:18    
PacksProvenanceArgs                            interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:71:18    
CommandRegistrar                               type       libs/pi-extension/src/commands/index.ts:5:3                   
SessionMeta                                    type       libs/pi-extension/src/commands/index.ts:7:3                   
SubmitMissingRepromptEvent                     interface  libs/pi-extension/src/runtime/execute-pi-task.ts:2075:18      
RateLimitRetryOptions                          type       libs/sdk/src/retry.ts:5:15                                    
TaskArtifactAttemptInput                       interface  libs/task-artifact-service/src/task-artifacts.ts:62:18        
SuccessCriteriaRubricCriteri…                  interface  libs/task-ui/src/success-criteria.ts:80:18                    
RubricTemplate                                 interface  libs/task-ui/src/success-criteria.ts:123:18                   
AgentAdapter                                   type       packages/legreffier-cli/src/adapters/index.ts:13:15           
AgentAdapterOptions                            type       packages/legreffier-cli/src/adapters/index.ts:13:29           
ResolveInstallationStatus                      type       …ges/legreffier-cli/src/phases/portResolveInstallation.ts:6:13
VerifyInstallationStatus                       type       …ages/legreffier-cli/src/phases/portVerifyInstallation.ts:4:13
InitPhase                                      type       packages/legreffier-cli/src/state.ts:4:13                     
GoArtifactBuildStep                            type       tools/src/release/go-artifact-publisher.ts:74:13              
�[93m�[4mDuplicate exports�[24m�[39m (1)
GUEST_TASK_CONTEXT_MOUNT|GUEST_TASK_SKILLS_MOUNT  libs/pi-extension/src/vm-manager.ts
�[93m�[4mUnused catalog entries�[24m�[39m (4)
@anthropic-ai/claude-agent-sdk  default  pnpm-workspace.yaml:25:4 
@fastify/static                 default  pnpm-workspace.yaml:37:4 
@openai/codex-sdk               default  pnpm-workspace.yaml:62:4 
zod                             default  pnpm-workspace.yaml:153:3
�[33m�[4mConfiguration hints�[24m (4)�[39m
. �[90m(root)�[39m         knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["."]�[90m (16 unused files)�[39m           
tools            knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["tools"]�[90m (15 unused files)�[39m       
apps/rest-api    knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/rest-api"]�[90m (4 unused files)�[39m
apps/mcp-host    knip.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/mcp-host"]�[90m (2 unused files)�[39m
 ELIFECYCLE  Command failed with exit code 1.

@getlarge getlarge changed the title Queue task deletion cleanup asynchronously feat: add queue for task deletion cleanup Jun 30, 2026
legreffier Bot added 5 commits June 30, 2026 16:43
@legreffier
fix(tasks): type async delete route body
1418362 
MoltNet-Diary: 9ea72cf4-2605-43f0-a789-8d852cfc658c

Task-Group: async-task-delete
@legreffier
fix(tasks): dedupe async deletion batches
d65950e 
MoltNet-Diary: 0cfd41d8-f356-479e-9ee1-03728c15ab9d

Task-Group: async-task-delete
@legreffier
chore(tasks): format deletion dedupe changes
15faec3 
MoltNet-Diary: 5790b667-41e9-418f-aad3-0437fca68f7a

Task-Group: async-task-delete
@legreffier
fix(tasks): handle duplicate deletion enqueue
1cb9853 
MoltNet-Diary: c873c13a-833b-4838-ac5f-8c8282d130a8

Task-Group: async-task-delete
@legreffier
test(tasks): cover duplicate async deletion e2e
dd39d0c 
MoltNet-Diary: 6a3d95d4-77dd-468e-92e9-ed85fb5b1398

Task-Group: async-task-delete
@legreffier legreffier Bot mentioned this pull request Jul 2, 2026
Open
@legreffier
fix(tasks): harden async deletion cleanup
bf1de4e 
MoltNet-Diary: 922f9cba-ab2b-405e-9493-263c8c759d17

Task-Group: async-task-delete
@getlarge
getlarge marked this pull request as ready for review July 2, 2026 19:36
@legreffier
test(console): align task cleanup e2e with async delete
2b9495b 
MoltNet-Diary: be77fd39-579e-4e5b-ae39-43044e7e7ff5

Task-Group: async-task-delete
@legreffier

legreffier Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor Author

Complexity Review Judgment

  • Composite Score: 0.75
  • Overall Verdict: Well-implemented and thoroughly tested feature that improves system reliability by offloading cleanup to a workflow. The primary risk is the breaking API change, which is handled by synchronized updates to the SDK and Console.

Criterion Results:

  • cognitive_load: ✅ Pass
  • blast_radius: ❌ Fail
  • test_coverage_delta: ✅ Pass
  • security_surface: ✅ Pass
  • reviewer_orientation: ✅ Pass

Rationale:
The main complexity driver and risk is the breaking change to the public API contract for (transition from to ). While this is mitigated by updating the SDK and Console in the same PR, it constitutes a contract change that increases the blast radius. All other aspects—including the new DBOS workflow and the permission—are well-isolated, logically coherent, and thoroughly tested.

@legreffier
style(console): format task cleanup e2e
f87e7ff 
MoltNet-Diary: 1afe10ab-32e7-4086-b065-f6be451ae480

Task-Group: async-task-delete
@getlarge
getlarge merged commit 6c3e473 into main Jul 3, 2026
57 of 58 checks passed
@getlarge
getlarge deleted the codex-async-task-delete branch July 3, 2026 07:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@getlarge