wip: capture renames/helioslite (audit 2026-07-24..08-02) - #128
wip: capture renames/helioslite (audit 2026-07-24..08-02)#128KooshaPari wants to merge 6 commits into
Conversation
…+ provenance docs
…x + landing/Caddy
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Large PR Alert: This PR touches 128 files. Consider splitting into smaller PRs for easier review. |
| console.log(`[deprecate-forge-dev] would run: cargo yank --version '*' on ${LEGACY}`); | ||
| console.log(`[deprecate-forge-dev] deprecation reason: "renamed to ${NEW_NAME}; legacy install path is keg_only"`); | ||
| console.log("[deprecate-forge-dev] dry-run complete; nothing was actually yanked."); |
There was a problem hiding this comment.
Suggestion: The deprecation step never performs the migration it advertises: it only searches crates.io and logs hypothetical yank output, then exits successfully. If this script is used as the release/deprecation operation, forge-dev remains active, no redirect README is published, and legacy users receive none of the promised migration behavior. Implement the authenticated crates.io operations or fail explicitly instead of reporting a successful dry run. [incomplete implementation]
Severity Level: Major ⚠️
- ❌ crates.io `forge-dev` remains active and unchanged.
- ⚠️ Gate 4b packaging migration remains incomplete.
- ⚠️ Legacy users receive no crates.io migration notice.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** packaging/crates/deprecate-forge-dev.mjs
**Line:** 34:36
**Comment:**
*Incomplete Implementation: The deprecation step never performs the migration it advertises: it only searches crates.io and logs hypothetical yank output, then exits successfully. If this script is used as the release/deprecation operation, `forge-dev` remains active, no redirect README is published, and legacy users receive none of the promised migration behavior. Implement the authenticated crates.io operations or fail explicitly instead of reporting a successful dry run.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| let primary = std::env::var("HELIOSLITE_UPDATE_URL") | ||
| .unwrap_or_else(|_| "https://helioslite.dev/cli".to_string()); |
There was a problem hiding this comment.
Suggestion: HELIOSLITE_UPDATE_URL is inserted directly into a command executed through a raw shell. A value containing shell metacharacters such as command separators or substitutions changes the command executed during automatic updates, allowing arbitrary commands to run whenever the update path is invoked. Validate the URL strictly and pass it as an argument rather than interpolating it into shell source. [security]
Severity Level: Major ⚠️
- ❌ Update execution can run unintended local shell commands.
- ⚠️ Automatic updates inherit the CLI process privileges.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/forge_main/src/update.rs
**Line:** 18:19
**Comment:**
*Security: `HELIOSLITE_UPDATE_URL` is inserted directly into a command executed through a raw shell. A value containing shell metacharacters such as command separators or substitutions changes the command executed during automatic updates, allowing arbitrary commands to run whenever the update path is invoked. Validate the URL strictly and pass it as an argument rather than interpolating it into shell source.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| let output = match api | ||
| .execute_shell_command_raw(&format!("curl -fsSL {primary} | sh")) | ||
| .await | ||
| { | ||
| Ok(o) => o, | ||
| Err(_) => api | ||
| .execute_shell_command_raw(&format!("curl -fsSL {fallback} | sh")) | ||
| .await | ||
| .unwrap_or_else(|e| e), | ||
| }; |
There was a problem hiding this comment.
Suggestion: The fallback runs only when spawning or waiting for the shell returns an error. A failed curl -f in curl ... | sh normally still yields an Ok(ExitStatus) because the shell pipeline exits with the final sh status, so an unreachable or HTTP-failing primary endpoint can be treated as a successful update and the legacy URL is never attempted. Check the returned exit status and retry when it is unsuccessful. [incorrect condition logic]
Severity Level: Major ⚠️
- ❌ Legacy update URL is not attempted when primary HTTP access fails.
- ⚠️ Users can receive no update despite the documented fallback.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/forge_main/src/update.rs
**Line:** 22:31
**Comment:**
*Incorrect Condition Logic: The fallback runs only when spawning or waiting for the shell returns an error. A failed `curl -f` in `curl ... | sh` normally still yields an `Ok(ExitStatus)` because the shell pipeline exits with the final `sh` status, so an unreachable or HTTP-failing primary endpoint can be treated as a successful update and the legacy URL is never attempted. Check the returned exit status and retry when it is unsuccessful.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| // HeliosLite rename (2026-07-06): FORGE_API_KEY -> HELIOSLITE_API_KEY. | ||
| // Users on the legacy KooshaPari/forgecode pre-rename build keep working | ||
| // until they rotate their env. Symmetric with the OLLAMA/VLLM/LM_STUDIO | ||
| // fallbacks above. Will be removed in a future major. | ||
| "HELIOSLITE_API_KEY" => Some("FORGE_API_KEY"), |
There was a problem hiding this comment.
Suggestion: The new legacy mapping is only applied to URL parameters, while the Forge provider declares HELIOSLITE_API_KEY as api_key_vars and retrieves it directly. Therefore users who only have FORGE_API_KEY set still receive env_var_not_found and cannot migrate their credentials; apply the fallback to API-key lookup as well. [api mismatch]
Severity Level: Major ⚠️
- ❌ Legacy `FORGE_API_KEY` users cannot authenticate to the Forge provider.
- ⚠️ Rename compatibility works for URL parameters but not credentials.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/forge_repo/src/provider/provider_repo.rs
**Line:** 113:117
**Comment:**
*Api Mismatch: The new legacy mapping is only applied to URL parameters, while the Forge provider declares `HELIOSLITE_API_KEY` as `api_key_vars` and retrieves it directly. Therefore users who only have `FORGE_API_KEY` set still receive `env_var_not_found` and cannot migrate their credentials; apply the fallback to API-key lookup as well.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| tracing_subscriber::EnvFilter::try_from_env( | ||
| // Additive rename: HELIOSLITE_LOG wins, falls back to FORGE_LOG | ||
| // (which is the upstream / pre-rename env name). | ||
| std::env::var("HELIOSLITE_LOG") | ||
| .or_else(|_| std::env::var("FORGE_LOG")) | ||
| .ok() | ||
| .as_deref(), | ||
| ) |
There was a problem hiding this comment.
Suggestion: EnvFilter::try_from_env expects an environment-variable name as a string reference, but this passes Option<&str> containing the environment variable's value. This causes the tracker crate to fail its type checking; use the filter constructor intended for an optional filter expression instead. [api mismatch]
Severity Level: Critical 🚨
- ❌ Workspace builds fail in the tracker crate.
- ❌ CLI binaries cannot compile with the changed logging code.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/forge_tracker/src/log.rs
**Line:** 33:40
**Comment:**
*Api Mismatch: `EnvFilter::try_from_env` expects an environment-variable name as a string reference, but this passes `Option<&str>` containing the environment variable's value. This causes the tracker crate to fail its type checking; use the filter constructor intended for an optional filter expression instead.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| pushd "$(cd "$(dirname "$0")" && pwd)/.." >/dev/null | ||
| cargo build --release --bin helioslite | ||
| popd >/dev/null | ||
| cp "target/release/helioslite" "$INSTALL_DIR/helioslite" |
There was a problem hiding this comment.
Suggestion: The documented --local invocation from the repository root changes into the parent of the script directory before running Cargo. Since the script is at the repository root, this points outside the workspace, so Cargo cannot find the workspace manifest and the local installation fails. Build from the script's directory or locate the repository root explicitly. [state/lifecycle]
Severity Level: Major ⚠️
- ❌ Documented local installation fails from the repository root.
- ⚠️ Developers cannot use the source-build installation path.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** install.sh
**Line:** 79:82
**Comment:**
*State Lifecycle: The documented `--local` invocation from the repository root changes into the parent of the script directory before running Cargo. Since the script is at the repository root, this points outside the workspace, so Cargo cannot find the workspace manifest and the local installation fails. Build from the script's directory or locate the repository root explicitly.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| Write-Err "cargo not on PATH — install rustup: https://rustup.rs/" | ||
| exit 1 | ||
| } | ||
| Push-Location (Resolve-Path "$PSScriptRoot\..") |
There was a problem hiding this comment.
Suggestion: When the documented pwsh ./install.ps1 -Local command is run from the repository root, $PSScriptRoot already points to that root. Appending .. moves Cargo to the parent directory, where the workspace manifest and target\release\helioslite.exe do not exist, so the local build and copy fail. [logic error]
Severity Level: Major ⚠️
- ❌ Documented local Windows installation fails.
- ⚠️ Users cannot build and install from a checkout.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** install.ps1
**Line:** 56:56
**Comment:**
*Logic Error: When the documented `pwsh ./install.ps1 -Local` command is run from the repository root, `$PSScriptRoot` already points to that root. Appending `..` moves Cargo to the parent directory, where the workspace manifest and `target\release\helioslite.exe` do not exist, so the local build and copy fail.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| header_up X-Forwarded-Proto {scheme} | ||
| } | ||
| rate_limit helioslite_public_rl | ||
| header /strict-transport-security "max-age=31536000; includeSubDomains" |
There was a problem hiding this comment.
Suggestion: The HSTS header is configured with /strict-transport-security as the first argument, which is interpreted as a path matcher rather than the Strict-Transport-Security header field. Consequently, the public site will not emit the intended HSTS header; specify the actual header name and value, optionally with a separate matcher. [security]
Severity Level: Major ⚠️
- ⚠️ Public HeliosLite site lacks configured HSTS.
- ⚠️ HTTPS downgrade protection is not provided.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** ops/caddy/Caddyfile.helioslite
**Line:** 24:24
**Comment:**
*Security: The HSTS header is configured with `/strict-transport-security` as the first argument, which is interpreted as a path matcher rather than the `Strict-Transport-Security` header field. Consequently, the public site will not emit the intended HSTS header; specify the actual header name and value, optionally with a separate matcher.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| Write-Host "[helioslite installer] download from https://github.com/KooshaPari/heliosLite/releases" | ||
| Write-Host "[helioslite installer] verifying sha256 sum against published checksums" | ||
| Write-Host "[helioslite installer] running in legacy mode (OMNIROUTE_LEGACY=1) — set to 0 for the renamed CLI" | ||
| return 0 |
There was a problem hiding this comment.
Suggestion: This Chocolatey install script only prints messages claiming that a release will be downloaded and verified, then returns success without downloading, extracting, or installing any executable. Chocolatey will report a successful installation while leaving helioslite unavailable. [incomplete implementation]
Severity Level: Major ⚠️
- ❌ Chocolatey installation cannot install HeliosLite.
- ❌ Users receive no usable `helioslite` executable.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** packaging/chocolatey/tools/chocolateyinstall.ps1
**Line:** 12:15
**Comment:**
*Incomplete Implementation: This Chocolatey install script only prints messages claiming that a release will be downloaded and verified, then returns success without downloading, extracting, or installing any executable. Chocolatey will report a successful installation while leaving `helioslite` unavailable.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| desc "KooshaPari/forgecode → HeliosLite. AI-DD/HITL-less coding agent." | ||
| homepage "https://helioslite.dev" | ||
| url "https://github.com/KooshaPari/heliosLite/archive/refs/tags/v#{version}.tar.gz" | ||
| sha256 "<set at tag time>" |
There was a problem hiding this comment.
Suggestion: The formula leaves the source checksum as a literal placeholder. Homebrew validates sha256 against the downloaded archive, so every installation from this formula will fail checksum validation until the checksum for the referenced tag is supplied. [api mismatch]
Severity Level: Major ⚠️
- ❌ Homebrew archive validation fails.
- ❌ HeliosLite cannot install from this formula.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** packaging/homebrew/helioslite.rb
**Line:** 5:5
**Comment:**
*Api Mismatch: The formula leaves the source checksum as a literal placeholder. Homebrew validates `sha256` against the downloaded archive, so every installation from this formula will fail checksum validation until the checksum for the referenced tag is supplied.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
|
||
| # Renamed binary `helioslite`. Legacy aliases `forge` and `forge-dev` | ||
| # remain installed so existing automations keep working. | ||
| kegg_only :versioned_formula if (ARGV.named["as"].nil? && tap_git?(formula["tap"])) || ARGV.named["as"].to_s == formula["name"] |
There was a problem hiding this comment.
Suggestion: kegg_only is not the Homebrew Formula DSL method; the method is keg_only. Loading this formula therefore fails before Homebrew can install it. [api mismatch]
Severity Level: Major ⚠️
- ❌ Homebrew cannot load the HeliosLite formula.
- ❌ `brew install helioslite` never reaches compilation.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** packaging/homebrew/helioslite.rb
**Line:** 11:11
**Comment:**
*Api Mismatch: `kegg_only` is not the Homebrew Formula DSL method; the method is `keg_only`. Loading this formula therefore fails before Homebrew can install it.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| def install | ||
| system "cargo", "install", *std_cargo_args( | ||
| path: "crates/forge_main", | ||
| bins: ["helioslite", "forge", "forge-dev", "pheno-shell", "pheno-winterminal"], |
There was a problem hiding this comment.
Suggestion: The forge_pheno_shell manifest defines only a library target, and forge_pheno_winterminal has no binary target at all. Passing both names through bins makes cargo install request nonexistent binaries and abort the formula installation before the smoke tests run. [api mismatch]
Severity Level: Major ⚠️
- ❌ Homebrew compilation aborts on nonexistent binary targets.
- ❌ No HeliosLite binaries are installed.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** packaging/homebrew/helioslite.rb
**Line:** 20:20
**Comment:**
*Api Mismatch: The `forge_pheno_shell` manifest defines only a library target, and `forge_pheno_winterminal` has no binary target at all. Passing both names through `bins` makes `cargo install` request nonexistent binaries and abort the formula installation before the smoke tests run.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fixThere was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b22dc4622
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| { | ||
| "id": "forge", | ||
| "api_key_vars": "FORGE_API_KEY", | ||
| "api_key_vars": "HELIOSLITE_API_KEY", |
There was a problem hiding this comment.
For users who already configured the default forge provider with only FORGE_API_KEY, this rename makes credential migration fail because create_credential_from_env still looks up only the configured api_key_vars value directly; the new legacy_env_var_fallback is only consulted for URL parameters, not API keys. Until the API-key path checks the legacy fallback too, existing installations lose access to the provider unless they manually duplicate the env var as HELIOSLITE_API_KEY.
Useful? React with 👍 / 👎.
| let output = match api | ||
| .execute_shell_command_raw(&format!("curl -fsSL {primary} | sh")) | ||
| .await | ||
| { | ||
| Ok(o) => o, | ||
| Err(_) => api | ||
| .execute_shell_command_raw(&format!("curl -fsSL {fallback} | sh")) |
There was a problem hiding this comment.
When helioslite.dev/cli is missing or returns a curl failure, execute_shell_command_raw still returns Ok(ExitStatus) once the shell spawned, so this match never reaches the forgecode.dev/cli fallback for normal download failures. In the rename window where the primary endpoint can 404 or be unavailable, updates silently fail instead of using the advertised legacy bootstrap URL; retry based on an unsuccessful status or download before invoking sh.
Useful? React with 👍 / 👎.
| pushd "$(cd "$(dirname "$0")" && pwd)/.." >/dev/null | ||
| cargo build --release --bin helioslite | ||
| popd >/dev/null | ||
| cp "target/release/helioslite" "$INSTALL_DIR/helioslite" |
There was a problem hiding this comment.
With the documented ./install.sh --local path from the repo root, this pushd moves to the parent of the repository, so cargo build --bin helioslite runs outside the workspace and fails; even if invoked through another path, the later cp target/release/helioslite is relative to the caller after popd. Build and copy from the script directory/repo root so local source installs work.
Useful? React with 👍 / 👎.
| Push-Location (Resolve-Path "$PSScriptRoot\..") | ||
| try { | ||
| cargo build --release --bin helioslite |
There was a problem hiding this comment.
The documented pwsh ./install.ps1 -Local flow has the same path issue on Windows: when the script lives at the repository root, Resolve-Path "$PSScriptRoot\.." enters the parent directory before running Cargo, so the local install cannot find this workspace and fails before copying helioslite.exe. Use $PSScriptRoot as the build root for this root-level script.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,51 @@ | |||
| class HeliosLiteFormula < Formula | |||
There was a problem hiding this comment.
For a formula file named helioslite.rb, Homebrew resolves the class it should load from the file name, but this defines HeliosLiteFormula instead, so brew install helioslite cannot load the formula before it ever reaches the Cargo build. Rename the class to the file-derived formula class and keep the rest of the DSL under that class.
Useful? React with 👍 / 👎.
| Class Program | ||
| { | ||
| [Microsoft.PowerShell.Commands.WebRequestPSCmdlet] | ||
| static int Main(string[] args) |
There was a problem hiding this comment.
Chocolatey runs tools/chocolateyinstall.ps1 as PowerShell, but this file starts with C#-style method syntax (static int Main(string[] args)) and // comments, which PowerShell will not parse as an install script. Any choco install helioslite package built from this nuspec fails before doing the advertised download or checksum verification.
Useful? React with 👍 / 👎.
| env: | ||
| HELIOSLITE_REPO: "{{.GITEA_REPOSITORY | default \"KooshaPari/heliosLite\"}}" | ||
| HELIOSLITE_CARGO_PROFILE: | ||
| sh: 'cargo info --quiet 2>/dev/null && echo dev || echo release' |
There was a problem hiding this comment.
WARNING: cargo info is not a valid Cargo subcommand
cargo info does not exist in stock Cargo, so HELIOSLITE_CARGO_PROFILE always falls through to release. Use a real check to detect the dev environment.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| - helioslite | ||
| - forge-dev | ||
| FileExtensions: [] | ||
| ManifestType: singleton |
There was a problem hiding this comment.
WARNING: Duplicate ManifestType keys
A winget manifest must declare exactly one ManifestType. This file declares both versioned (line 21) and singleton (line 34); YAML parsers take the last value, but winget validation rejects duplicate keys. Remove one declaration.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| # phenomonitor is gated by mTLS upstream; basicauth is a | ||
| # pre-flight deny for clients that don't present a valid | ||
| # phenomonitor bearer. | ||
| phenomonitor_admin $2a$14$1V6k0hlIW2dqh8.fAOj6duXJu7qdtWi6P1jj1DcPVRlg5Yr0VoVoK |
There was a problem hiding this comment.
WARNING: Bcrypt password hash stored in plaintext in source control
The phenomonitor_admin password hash is embedded directly in the Caddyfile. Storing hashes in source control prevents credential rotation without a code change and exposes the credential to anyone with repository access. Move the hash to a secret manager or environment variable.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| </metadata> | ||
| <files> | ||
| <file src="tools\**" target="tools" /> | ||
| <file src="legal\**" target="legal" /> |
There was a problem hiding this comment.
WARNING: legal\** references a non-existent directory
The <file src="legal\**" target="legal" /> glob points to a directory that does not exist in this repository. Chocolatey will fail when building the package. Remove the entry or add the missing directory.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| timeout-minutes: 60 | ||
| env: | ||
| HELIOSLITE_REPO: ${{ github.repository }} | ||
| HELIOSLITE_RELEASES_BACKEND: "github" |
There was a problem hiding this comment.
SUGGESTION: Unused environment variable
HELIOSLITE_RELEASES_BACKEND is set at line 26 but never referenced in any workflow step. Remove it or wire it into the build to avoid dead configuration.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "headers": [ | ||
| { "key": "X-Frame-Options", "value": "DENY" }, | ||
| { "key": "X-Content-Type-Options", "value": "nosniff" }, | ||
| { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" } |
There was a problem hiding this comment.
SUGGESTION: Missing Strict-Transport-Security header
The Vercel headers block includes X-Frame-Options, X-Content-Type-Options, and Referrer-Policy, but omits Strict-Transport-Security. The Caddy reverse proxy attempts HSTS (though misconfigured per the existing review comment), but the Vercel-deployed site has no HSTS at all. Add Strict-Transport-Security: max-age=31536000; includeSubDomains.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| > # Migrate in 30 seconds | ||
| > cargo install helioslite --locked | ||
| > helioslite --version # canonical | ||
| > FORGE_LEGACY=1 forge-dev --version # legacy alias still works |
There was a problem hiding this comment.
WARNING: Undocumented and inconsistent legacy-silence env var
FORGE_LEGACY=1 is not implemented anywhere in the codebase and is inconsistent with HELIOSLITE_LEGACY=1 in docs/RENAMES-STRATEGY.md and HELIOSLITE_LEGACY_OFF=1 in docs/FORK.md. Remove the reference or implement the silencing flag and document it consistently.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| exposed as `[[bin]] name = "helioslite"` in `crates/forge_main/Cargo.toml`). | ||
| - **Legacy**: `forge`, `forge-dev` (kept in the same crate, same entry | ||
| point). The first invocation of either prints a one-time deprecation | ||
| notice (silence with `HELIOSLITE_LEGACY=1`). |
There was a problem hiding this comment.
WARNING: Undocumented and inconsistent legacy-silence env var
HELIOSLITE_LEGACY=1 is not implemented anywhere in the codebase and is inconsistent with HELIOSLITE_LEGACY_OFF=1 in docs/FORK.md and FORGE_LEGACY=1 in README.md. Remove the reference or implement the silencing flag and document it consistently.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| fallback in `crates/forge_repo/src/provider/provider_repo.rs` | ||
| (`legacy_env_var_fallback` mirrors the upstream `OLLAMA_HOST` | ||
| pattern); a one-time stderr notice recommends migrating to | ||
| `HELIOSLITE_API_KEY`. Set `HELIOSLITE_LEGACY_OFF=1` to silence. |
There was a problem hiding this comment.
WARNING: Undocumented and inconsistent legacy-silence env var
HELIOSLITE_LEGACY_OFF=1 is not implemented anywhere in the codebase and is inconsistent with HELIOSLITE_LEGACY=1 in docs/RENAMES-STRATEGY.md and FORGE_LEGACY=1 in README.md. Remove the reference or implement the silencing flag and document it consistently.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 9 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (9 files)
Note: |
|
Closing as superseded (stale WIP capture from 2026-07-26). Since this branch was captured, fork main has moved substantially:
All additive content this branch introduced (packaging/, apps/landing-helioslite/, docs/, install.sh/ps1, Taskfile.yml) already exists in main. The two-dot diff vs main deletes CI workflows (codeql/fuzz/scorecard/stale), assets, and audit docs while regressing merged fixes. Recreate from current main if the helioslite rename still needs to move forward. |
User description
Automated audit capture of local dirty state.
renames/heliosliteCodeAnt-AI Description
Introduce HeliosLite as the canonical CLI while preserving Forgecode compatibility
What Changed
helioslitecommand and installation paths for Linux, macOS, and Windows, while keepingforgeandforge-devworking as legacy aliasesHELIOSLITE_*settings, including API keys, logging, repository selection, and installation location, while accepting legacy variablesImpact
✅ New HeliosLite installation options✅ Existing Forgecode commands continue to work✅ Updates remain available during the repository rename💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.