[Mathis (echobt)]

Progress snapshot, not for merge.

This draft PR shows work in progress from the local worktree /root/cortex-dev/worktrees/task6-contracts-final-desktop. The branch progress/task6-contracts-final-desktop is a snapshot of that worktree's uncommitted changes on top of the base commit. It is refreshed with /root/cortex-dev/progress-prs/refresh.sh, which pushes a new fast-forward commit; the worktree itself is never modified. Local evidence (.omo/), dependencies, build output and env files are excluded. Every snapshot is scanned for secrets before it is pushed.

Scope

Desktop side of Task 6: vendors cortex-sdk 0.4.0 and cortex-api-types 0.3.0 and fixes the remote-chat cursor handling.

Status (from the orchestration ledger)

Part of the Task 6 contracts-final DoneClaim 2026-10-06T13:59 (desktop typecheck/lint 0, 356/356 + 1 skip). Gate: pending, together with the backend contracts-final tree.

Ledger: /root/omo-herdr-wt/hermes-docs-qa-docs-attempt2/.omo/ulw-execute/ledger.jsonl

Evidence (local paths on the dev host, not in this branch)

• backend worktree task6-contracts-final: .omo/ContractsFinalDoneClaim.json

Summary by CodeRabbit

• Bug Fixes
  • Remote chat now accepts complete Redis stream IDs as event cursors, including large values, and uses them consistently when resuming event streams.
  • Repeated events with the same cursor are suppressed, while distinct events can be replayed using their full cursors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a65b84d4-9f99-4fc5-85d3-73185d18a9dd

---

📥 Commits

Reviewing files that changed from the base of the PR and between decf580 and 14b5c01.

---

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

---

📒 Files selected for processing (9)

• AGENTS.md
• packages/desktop/package.json
• packages/desktop/src/remote-chat.ts
• packages/desktop/test/remote-chat.test.ts
• packages/desktop/test/remote-core.test.ts
• tests/e2e/remote-chat.spec.ts
• vendor/README.md
• vendor/cortex-api-types-0.3.0.tgz
• vendor/cortex-sdk-0.4.1.tgz

---

Limit details: You’ve used all 10 included reviews currently available.

---

---

📝 Walkthrough

Walkthrough

The desktop package updates its vendored SDK and API-types versions. Remote chat now validates full Redis stream IDs, and unit and end-to-end tests use formatted cursors for replay and resume.

Changes

SDK pair and remote chat cursors

Layer / File(s)	Summary
Vendored SDK pair packages/desktop/package.json, AGENTS.md, vendor/README.md	The package now uses SDK 0.4.1 and api-types 0.3.0. The vendor documentation describes the pair's exports, typing changes, and body requirements.
Redis stream cursor validation and replay packages/desktop/src/remote-chat.ts, packages/desktop/test/remote-chat.test.ts, packages/desktop/test/remote-core.test.ts, tests/e2e/remote-chat.spec.ts	Cursor validation accepts canonical milliseconds-sequence IDs with each component bounded by the unsigned 64-bit maximum. Unit and end-to-end fixtures and replay assertions use full Redis stream IDs, including opaque large cursor strings.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

---

Merge Risk

Merge Risk: ⚪ Minimal · up to 14b5c

No actionable merge-blocking issue was identified in the SDK pair or remote-chat cursor changes. The PR remains a draft with its stated gate pending.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 14b5c

The update preserves existing authentication and destination restrictions. The main remaining uncertainty is compatibility with the server’s cursor format during rollout and rollback; no introduced security regression was established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The inspected exposure remains the desktop’s authenticated remote session at its selected origin, including streamed conversation/message state and attachment operations. The changed cursor is a replay position within that binding, not a new destination, credential, or authority selector.

Trust Boundaries and Controls

• observed — The remote transport retains named same-origin route restrictions, redirect rejection, omission of ambient credentials, and active-identity invalidation on unauthorized responses. RemoteSession binds operations to the active origin, revision, token, and lifetime.
• observed — Base/head dependency inspection found the SDK authentication client implementation unchanged. The relevant bundled runtime changes concern stream parsing, duplicate/reset handling, and cursor replay rather than broader endpoint or credential authority.

Resilience and Maintainability Implications

• observed — The inspected transitions preserve stable admission identity, acknowledged-cursor recovery, and single-turn ownership across interruption and resume. Static fixtures cover observer refusal, mismatched identities, expired replay, truncated completion, and concurrent-turn rejection; these are source assertions, not independently executed test results.

---

---

---

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check		The description explains the snapshot scope and reports limited test results, but it omits most required template sections, including how to try it, honest states, risk and rollback, and the required …	Complete the required description sections. Add What changed, How to try it, Honest states, Verification, and Risk and rollback. Include the full attestation block with accurate checkbox states and reasons for unchecked items. Correct the S…
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check		The title clearly identifies the Task 6 desktop SDK adoption work. The progress-snapshot prefix adds status context but does not make the title unclear.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Description check

Explanation

The description explains the snapshot scope and reports limited test results, but it omits most required template sections, including how to try it, honest states, risk and rollback, and the required attestation. It also says SDK 0.4.0 while the changes use SDK 0.4.1.

Resolution

Complete the required description sections. Add What changed, How to try it, Honest states, Verification, and Risk and rollback. Include the full attestation block with accurate checkbox states and reasons for unchecked items. Correct the SDK version to 0.4.1 and provide verification details that match the current changes.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (3 skipped: 3 unsupported.)

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch progress/task6-contracts-final-desktop

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 7
• Waived: $1.75 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}