Read the moved dependency instead of guessing at it - #101
Conversation
The previous commit taught the reviewer to say "I could not read this"
once instead of speculating five times. This is the part that makes that
sentence unnecessary when the source can actually be had.
TUI#92 bumped kai-engine to v0.6.59-0.20260908192613-5ab1b102fc2f and
moved three call sites onto kaipath.UserPath, then spent most of its
output asking whether that function is variadic, whether it accepts zero
trailing components, and whether an empty override preserves the default —
and called the arity question "a real defect".
The answer is 491 bytes:
func UserPath(home string, parts ...string) string {
base := os.Getenv("KAI_DATA_DIR")
if base == "" {
base = filepath.Join(home, ".kai")
}
return filepath.Join(append([]string{base}, parts...)...)
}
Variadic; empty parts is fine; an empty override falls back. Every
question answered, in the file whose commit the diff itself carried.
## The mechanism
The pod has no Go toolchain and no module cache, so there is nothing on
disk to read. But it does have GITHUB_TOKEN — an installation token for an
app installed across the org, minted with no repository restriction — and
the contents API serves a directory at an exact commit. That is the whole
trick: the pinned commit out of the pseudo-version, the packages the diff
imports, one API call each.
Verified live against the real TUI#92 inputs: two files, 2,196 bytes,
zero unresolved.
## What it will not do
Only packages the diff actually imports, only github.com, only the plain
three-segment module form, and only with a commit in hand — a version tag
may not exist on the default branch, and reading the wrong revision of a
contract is worse than reading none. Test files are skipped: the question
is what the contract IS.
Hard caps, because turn 0 waits on this: 10s for everything, 3 packages,
6 files, 48KB. Preflight exists to buy turns, not sell them. A dependency
that cannot be read inside that budget is one the reviewer states as a
limit, which is exactly what the previous commit built.
## One result, two blocks
rcFetchDepSources returns what it read AND what it could not, and the
caller renders both. A block telling the reviewer it cannot read a module,
printed beside one containing that module's source, would be its own
contradiction — so whatever is fetched is removed from what the limitation
block claims. TestSourceAndLimitationBlocksDoNotOverlap holds that.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
jschatz1 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![kaicontext[bot]](https://avatars.githubusercontent.com/in/4190771?s=60&v=4){kind=small}
There was a problem hiding this comment.
Kai review
Kai Summary
This review did not finish, so treat the change as not reviewed — not as reviewed and clean. How far it got is below.
This review did not finish. After 10m0s and 15 turns, the review ran out of time before it could write its conclusion, and the follow-up request for a conclusion from the transcript also failed.
It had opened 4 file(s) before it stopped:
- cmd/kai/review_commit.go
- cmd/kai/review_commit_deps.go
- cmd/kai/review_commit_depsrc.go
- cmd/kai/review_commit_depsrc_test.go
Nothing here is a verdict on the change: no claim was checked to completion, so treat this as "not reviewed" rather than "reviewed and clean". Re-run the review, or split the change into smaller pieces if it keeps exhausting the budget.
Important files changed
| File | Change |
|---|---|
cmd/kai/review_commit.go |
modified · +12 −4 |
cmd/kai/review_commit_depsrc.go |
modified · +237 −0 |
cmd/kai/review_commit_depsrc_test.go |
modified · +80 −0 |
What I opened — 4 files, 15 turns, 10m0s
cmd/kai/review_commit.gocmd/kai/review_commit_deps.gocmd/kai/review_commit_depsrc.gocmd/kai/review_commit_depsrc_test.go
+329 −4 · 3 files · reaches 11 · the full analysis
💬 Reply to any of my comments and I'll answer, or say @kaicontext anywhere on this PR — a question, or "take another look at the retry logic".
1 participant
#99 taught the reviewer to say "I could not read this" once instead of speculating five times. This is the part that makes that sentence unnecessary when the source can actually be had.
The case, one more time
TUI #92 bumped kai-engine to
v0.6.59-0.20260908192613-5ab1b102fc2fand moved three call sites ontokaipath.UserPath, then spent most of its output asking whether that function is variadic, whether it accepts zero trailing components, and whether an empty override preserves the default — and called the arity question "a real defect".The answer is 491 bytes:
Variadic. Empty
partsis fine. An empty override falls back. Every question answered — in the file whose commit the diff itself carried.The mechanism
The pod has no Go toolchain and no module cache, so there is nothing on disk to read. But it has
GITHUB_TOKEN— an installation token for an app installed across the org, minted with no repository restriction (POST /app/installations/{id}/access_tokens, no body) — and the contents API serves a directory at an exact commit.I verified the scope rather than assuming it: the
kaicontextinstall app reportsrepository_selection=all, so the pod's token can reach sibling repos like kai-engine.Then: pinned commit out of the pseudo-version (parsed in #99), packages the diff imports, one API call each.
Verified live against the real TUI #92 inputs — 2 files, 2,196 bytes, 0 unresolved.
What it will not do
github.com, only the plain three-segment module form. A/v2suffix or a module in a repo subdirectory is refused: guessing a repo from a module path is how you fetch the wrong file and then state it with confidence.Hard caps, because turn 0 waits on this: 10s total, 3 packages, 6 files, 48KB. Preflight exists to buy turns, not sell them. Anything outside the budget falls back to #99's limitation block.
One result, two blocks
rcFetchDepSourcesreturns what it read and what it could not, and the caller renders both. A block telling the reviewer it cannot read a module, printed beside one containing that module's source, would be its own contradiction — so whatever is fetched is removed from what the limitation block claims.TestSourceAndLimitationBlocksDoNotOverlapholds that in both directions.Verified
Three tests, none touching the network: module→repo mapping including five forms that must be refused; the no-token / no-commit / non-github / no-imports paths all landing in
unresolvedso the limitation still covers them; and the two blocks never overlapping. Plus the live check above, run by hand.go vetclean,go test ./cmd/...green (exit 0).Caveat worth stating: the live run used my own token. The installation's
repository_selection=allis what says the pod's token will behave the same, and a 403/404 is handled identically to a miss — it falls back to the limitation block.🤖 Generated with Claude Code