Repository navigation
CHANGELOG for the October exploration fixes (#148–#161) — merge last - #163
Conversation
The [Unreleased] entries of PRs #148-#161, collected here so the fix PRs do not conflict with each other in CHANGELOG.md. Fixes that matter for safety or permissions come first under Fixed; the three "set back to nil" entries are one, and three page corrections made in other PRs are listed with the documentation entry. README: the sentence on what CI runs names Ruby 4.0 and the keyless smoke test the test-suite PR (#153) adds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNgMt2RjeBLyRP3CWFWNy2
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bec5d871d1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ### Changed | ||
| - `docs/cli-installer.md` now says when `CLIInstaller::PINNED_CLI_VERSION` moves: pin-only changes ship with the next gem release rather than one release per CLI bump. It also covers how a gem patch can move your CLI and how to take a newer CLI before a release pins it. The pin-bump workflow keeps a single `[Unreleased]` entry for the pin. | ||
| - `CLIInstaller::PINNED_CLI_VERSION` moves from 2.1.285 to **2.1.287**, following the CLI the Python SDK bundles. `CLIInstaller.install_pinned` installs it. See the [Claude Code changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md). | ||
| - **The Rails guide, both Rails examples and the generated initializer turn off the CLI's per-project auto-memory** (`env: { 'CLAUDE_CODE_DISABLE_AUTO_MEMORY' => '1' }`; commented out in the initializer). Every SDK session reads that memory and a `claude_code`-preset session writes it without a permission check, so in a multi-user app one user's "remember …" would reach every other user's session. If you copied those examples, add the line; the value must be `'1'`. ([#158](https://github.com/ya-luotao/claude-agent-sdk-ruby/pull/158)) |
There was a problem hiding this comment.
The generated initializer cannot “turn off” auto-memory if its env: entry is commented out, so a newly generated multi-user Rails app remains exposed to the cross-session memory sharing described here until the developer manually enables it. This security-sensitive release note gives contradictory guidance; either make the initializer setting active by default or say that the initializer only documents the opt-out.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 499a806: the entry now says the guide and both examples turn auto-memory off, and that the generated initializer only documents the switch (commented out), so a newly generated app is not isolated until it is uncommented. Making it active by default is one of the open maintainer decisions (the auto-memory default), so the template stays as it is in #158.
…witch The entry said the generated initializer turns auto-memory off, while its env: line is commented out — a newly generated multi-user app is not isolated until the developer uncomments it. The entry now says exactly that (found by the Codex review of this PR). Also folds in the fixes made after the Codex reviews of #152, #156 and #157: the binary's mode is synced after its chmod; a debug_stderr: sink and the sandbox warning are contained like the stderr: callback; tag: false no longer clears a tag. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNgMt2RjeBLyRP3CWFWNy2
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…and tags Folds in the two fixes made after the Codex re-reviews of #156 (a subclass that wraps the CLI gets cli_path as given) and #157 (a binary title or tag is read as UTF-8). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNgMt2RjeBLyRP3CWFWNy2
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Folds in the fixes made after the third Codex reviews of #156 (discovery searches the system directories when PATH is unset) and #157 (an off-chain result a dropped branch went on from is left out). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CNgMt2RjeBLyRP3CWFWNy2
1 participant
What and why
The
## [Unreleased]entries for the fourteen fix PRs of the October exploration batch (#148–#161), collected inone place so that the fix PRs do not conflict with each other in
CHANGELOG.md. Under Fixed, the entries thatmatter for safety or permissions come first (hook decisions ignored, sandbox rules not applied, "always allow" not
persisted,
tools:String ignored, sessions of another project, a relative CLI path running another binary,credentials in
#inspect, secrets left in a preserved resume dir). Three "set back tonil" entries from three PRsare one entry here, and three page corrections made inside other PRs are listed with the documentation entry.
Also
README.md: the sentence on what CI runs names Ruby 4.0 and the keyless smoke test that #153 adds.Please merge this one last. Every entry links its PR.
Merge order
All fifteen branches were merged onto current
main(9d2abff) in this order in a scratch checkout, with noconflict, and the whole tree was checked:
bundle exec rspecon the lockfile,gemfiles/latest.gemfileandgemfiles/floor.gemfile— 3556 examples, 0 failures each; RuboCop clean;rake rbs:validate rbs:test(3192 examples); the Rails specs on Rails 7.1 and 8 (180 each);formal/tla/run.shas expected. The same merged tree also passed the full CI matrix — Linux Ruby 3.2 / 3.3 / 3.4 / 4.0, macOS, the dependency floor and latest legs, Rails, the RBS runtime check and the keyless CLI smoke — in a throwaway draft PR (#162, closed). The first local run of the merged tree found two interactions between PRs, both fixed in their own PRs before that: a spec helper in #154 that shadowed RSpec'sreceiveonce #159's suite-wide stub is in, and arubocop:disablethat #157 and #159 together made redundant.CI legs flaky once each)
configuration.md#session-isolation)As a loop (stops at the first failure):
Checklist
bundle exec rakepasses on the merged tree (see above)## [Unreleased]README.md)🤖 Generated with Claude Code
https://claude.ai/code/session_01CNgMt2RjeBLyRP3CWFWNy2