Count the tools the container actually starts - #42
Merged
Conversation
The file said seven of nine. It has been ten since write_report shipped, and only check_paraphrase and measure_predictability can open a socket at all — both opt-in. This comment is read by people deciding whether to trust a container that analyses student coursework, so a stale count in it costs more than it looks. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
peopleworks
added a commit
that referenced
this pull request
Aug 10, 2026
The second reviewer returned DO NOT SHIP with five reproducible findings. All five were confirmed by test before being fixed, and all five failed first. **An image is a request.** Escaping the angle bracket blocks raw HTML and does nothing to ``. The page's own last line says nothing here was uploaded anywhere; a report that fetches a pixel from somebody else's host the moment a teacher pastes it into the LMS has broken that sentence, and the fetch carries the moment they opened it. Escaping the opening bracket covers images and links both. **An asterisk captured the report's own prose.** The signal row is the matched text followed by the report's `*→ suggestion*`, so one asterisk from the document paired with the report's marker: emphasis opened at the document's character and closed at the report's, swallowing the explanation into the document's content, and the matched character vanished. That is issue #37's third item, deferred as cosmetic two commits ago and demonstrably not cosmetic. Fixing it needed the order reversed. Resolving the escapes and then escaping for HTML puts a live asterisk back before the emphasis pass runs, so the two are now one pass, and an escaped asterisk returns as `*` — a literal asterisk to every renderer, exactly as `<` is a literal bracket, and not a character the emphasis pass can see. `_` and `` ` `` are deliberately left alone: neither can pair with a marker this report writes on the same line, so the worst they do is italicise a document's own text, and escaping them would put a backslash in front of the underscore in every filename a teacher reads. **Three more values reaching the page unescaped.** The analysed language, which `Analyze` takes from its caller and the MCP server takes as free text from a model; `GeneratedOn` and `EngineVersion`, public settable strings on the same record whose `DocumentName` was already routed. A newline in either forged a second heading in the report's own voice. **`Cell` trimmed the evidence.** A rule whose regex includes the surrounding spaces matches them, and they are part of the span in the document. Dropped, on the page whose claim is that it reproduces what the document said. The cost is one backslash in the raw Markdown of a real report — `cites \[3]` — which the HTML resolves back to `[3]`, with no stray backslash anywhere on the page. Checked by reading the generated report, not only the assertions. The reviewer also confirmed the ordering against every edge asked for, and 100,000 findings sorted and truncated in 41 ms. Five new tests, 361 green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-line comment fix. The Dockerfile claimed seven of the nine tools never open a socket; it has been ten tools since
write_reportshipped in 0.4.0, and eight of them never open one — onlycheck_paraphraseandmeasure_predictabilitycan, both opt-in.Noticed while checking why Glama still lists nine tools after a sync: its metadata comes from the repository and refreshes immediately, but the tool list requires rebuilding and starting the container, which lags. The build spec needs no change — the Dockerfile builds from source, so the rebuild will find all ten.
This comment is read by people deciding whether to trust a container that analyses student coursework.
🤖 Generated with Claude Code