github/codegraph
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(security): remove dead reasoning-offload modules flagged in #1114 (#1132)

Browse Source 
The managed-reasoning removal (e5897d03) stripped the CLI/MCP wiring but,
despite its stated intent, left the offload modules and their test suite
behind. The dead code still shipped compiled inside the platform bundles,
and its Windows browser-opener was flagged by a security report (#1114)
for routing the login URL through `cmd /c start`, where cmd re-parses
shell metacharacters. Unreachable since 2026-06-20 and never wired in any
tagged release — but delete it for real: src/reasoning/ (config,
credentials, login, reasoner), __tests__/offload.test.ts, the now-inert
CODEGRAPH_OFFLOAD_DISABLE guard in dynamic-boundaries.test.ts, and the
stale reasoner reference in the FILE_SECTION_PREFIX comment.

Closes #1114

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Colby Mchenry
2026-07-02 12:56:02 -05:00
committed by GitHub
co-authored by Claude Fable 5
parent e53968cae8
commit 04e23917d0
8 changed files with 3 additions and 898 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/dynamic-boundaries.test.ts
+1 -14
View File
@@ -8,7 +8,7 @@
* showing nothing. Deterministic, query-time only, no graph mutation, and a
* fully connected flow must never produce the section.
*/
import { describe, it, expect, beforeAll, afterAll, afterEach } from 'vitest';
import { describe, it, expect, afterEach } from 'vitest';
import * as fs from 'fs';
import * as path from 'path';
import * as os from 'os';
@@ -16,19 +16,6 @@ import CodeGraph from '../src/index';
import { ToolHandler } from '../src/mcp/tools';
import { scanDynamicDispatch } from '../src/mcp/dynamic-boundaries';
// These suites assert on the RAW codegraph_explore output (the Flow / boundary
// sections). The managed reasoning-offload, when configured on the dev machine
// (~/.codegraph/config.json `{"offload":{"managed":true}}`), REPLACES that output
// with a remote Cerebras synthesis — so the structural assertions only hold with
// the offload off. Disable it for this file so the suite is hermetic regardless
// of machine config, then restore.
let _prevOffloadDisable: string | undefined;
beforeAll(() => { _prevOffloadDisable = process.env.CODEGRAPH_OFFLOAD_DISABLE; process.env.CODEGRAPH_OFFLOAD_DISABLE = '1'; });
afterAll(() => {
if (_prevOffloadDisable === undefined) delete process.env.CODEGRAPH_OFFLOAD_DISABLE;
else process.env.CODEGRAPH_OFFLOAD_DISABLE = _prevOffloadDisable;
});
// ---------------------------------------------------------------------------
// Unit: the scanner
// ---------------------------------------------------------------------------