GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing github.com — (7/9) No nearby AGENTS.md on reads in a session without instruction files by Obed0101 · Pull Request #134 · MendCode/MendCode Conversation
|
|
MendCode: @Obed0101's MendCode worked on this pull request on one of its devices; released 2026-11-10 19:25 UTC. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
No findings · nothing in this change was confirmed as a problem
head 9d72b91b8cda
Merge risk: 🟡 Medium · The change crosses the session-policy and shared tool-execution boundary and controls whether untrusted checkout instructions reach a reviewer. The implementation is small and preserves unrestricted-session behavior, but the added test exercises the tool-level flag rather than session-to-engine propagation.
Change: Bug fix · Review effort: 1/5, about 5 minutes
This change suppresses nearby instruction injection during native-engine tool calls when a session has noContextFiles enabled, with a regression test confirming that ordinary file content remains readable. All four reader-summarized code files were independently inspected, along with the changelog and relevant callers; no defect introduced by this stack segment was verified. Tests were not run in this read-only review, and the supplied performance regressions are left to the system's separate findings.
Readers: 4 files went to readers instead of the review pass whole: 4 code files by gpt-6-luna (the review pass gets their summaries and the hunks of their risk spots; 1 call, up to 3 at once, 8,786 tokens counted). Their summaries are hints, not findings. 1 code file no reader could read went to the review pass whole (the reader gave no usable answer for this file).
Stacked on #133: only this pull request's own commits since #133's head 785277d.
The native engine now translates the existing session-level noContextFiles limit into an InstructionOptions.off flag for synchronous and asynchronous tool execution. The nearby-instruction reader returns no instruction text or claims when that flag is set, while the read tool still returns the requested file. The same options are passed to orientation generation, although its existing instruction-file discovery does not consume off; mention expansion also remains unchanged.
Changes
| Layer / files | Summary |
|---|---|
Native-engine session policy packages/engine-native/src/engine.ts |
Adds noContextFiles to the native run-limit contract and derives session-specific instruction options for tool execution and orientation. |
Nearby instruction loading packages/tools/src/instructions.ts, packages/tools/src/read-instructions.ts |
Defines the optional off flag and makes nearby instruction loading return empty results when it is enabled. |
Regression coverage packages/tools/test/read-instructions.test.ts |
Verifies that disabling nearby instructions preserves source output, excludes neighboring rules, and leaves instruction claims empty. |
Release notes CHANGELOG.md |
Documents that PR-review file reads no longer automatically load neighboring AGENTS.md instructions. |
Sequence diagram
sequenceDiagram
participant Engine as Native engine
participant Limits as Session run limits
participant Read as Read tool
participant Instructions as Nearby instruction reader
Engine->>Limits: Get noContextFiles
Limits-->>Engine: Session policy
Engine->>Read: Execute with instructions.off
Read->>Instructions: readInstructions(file, context)
alt off is true
Instructions-->>Read: Empty text and loaded claims
else off is absent or false
Instructions-->>Read: Existing nearby instruction behavior
end
Read-->>Engine: Requested file output
| Check | Status | Explanation |
|---|---|---|
| Title | ✅ Passed | The title accurately describes suppressing nearby AGENTS.md loading on reads in sessions configured without instruction files. |
| Description | ✅ Passed | The description identifies the PR-review behavior being fixed, states the additional run-limit lookup, and reports head-level typechecking and top-of-stack suite results. Those reported checks were not independently executed here. |
| Out of scope | ✅ Passed | The changes are confined to instruction-policy propagation, nearby-read suppression, regression coverage, and the corresponding release note. |
Performance (perf-attrib, base 785277d against head 9d72b91)
perf-attrib: baja: tui.after.heap.protected -1
base 785277dbae21b3f364b365ed6e78e02fd6c08280 (785277db) vs cand 9d72b91b8cdaa40cb392ff84d087d7d56a0cde16 (9d72b91b), median of 2 faux-engine session(s) per side; flagged = beyond the noise measured on 18 base-vs-base runs (x1.5).
| metric | base | cand | diff |
|---|---|---|---|
| tui.after.fp_mb | 57.9 | 57.1 | -0.8 |
| tui.after.peak_mb | 73.3 | 73.1 | -0.2 |
| tui.ready.fp_mb | 54.7 | 54.7 | 0 |
| tui.ready.peak_mb | 73.3 | 73.1 | -0.2 |
| tui.rest.fp_mb | 57.2 | 56.8 | -0.4 |
| tui.rest.peak_mb | 73.3 | 73.1 | -0.2 |
| tui.after.rss_mb | 110.8 | 137.5 | +26.7 UP |
| tui.ready.rss_mb | 112.3 | 113.4 | +1.1 UP |
| tui.rest.rss_mb | 86.5 | 137.8 | +51.3 UP |
| tui.after.heap.extra_b | 7445050 | 6690312 | -754738 |
| tui.after.heap.objects | 242542 | 240596 | -1946 |
| tui.after.heap.protected | 20 | 19 | -1 down |
| tui.after.heap.size_b | 25252474 | 24302600 | -949874 |
| tui.ready.heap.extra_b | 2871277 | 2871313 | +36 |
| tui.ready.heap.objects | 216411 | 216419 | +8 |
| tui.ready.heap.protected | 18 | 18 | 0 |
| tui.ready.heap.size_b | 19242525 | 19242705 | +180 |
| tui.rest.heap.extra_b | 3726953 | 4624964 | +898011 |
| tui.rest.heap.objects | 235172 | 237690 | +2518 |
| tui.rest.heap.protected | 18 | 18 | 0 |
| tui.rest.heap.size_b | 20875209 | 22015940 | +1140731 |
| tui.rest.js_code_b | 4876852 | 5834987 | +958135 |
| tui.rest.js_live_b | 19205284 | 19240174 | +34890 |
| tui.cpu_ms.after | 6310 | 6198 | -112 |
| tui.cpu_ms.ready | 384 | 353 | -31 |
| tui.cpu_ms.rest | 549 | 524 | -25 |
| binary.bytes | 72290528 | 72290528 | 0 |
| disk.bytes | 4109 | 4111 | +2 |
| disk.bytes_per_session | 2055 | 2056 | +1 |
JS heap bytes by constructor that rose:
Modules loaded at start: 230 -> 230, 4631407 -> 4631504 bytes of chunks; chunk sizes only in cand: [250693, 181666], only in base: [250635, 181627] (chunk names are hashes: the list says which changed in size, not by what name)
Reference (skill, 2026-11-03, real model): footprint 64 ready / 66 after / peak 80 MB, 2.6 KB per session. This run (faux engine, whole process tree): 54.7 / 57.1 / peak 73.1 MB, 2056 B per session.
CHANGELOG.mdpackages/engine-native/src/engine.tspackages/tools/src/instructions.tspackages/tools/src/read-instructions.tspackages/tools/test/read-instructions.test.tsComment @mendcode review to review again · @mendcode pause / resume · reply to a finding with explain, fix or learn · settings in .mendcode/review.yaml
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.