[BANANASJIM]

What

Keep the daemon available when unauthenticated clients send invalid requests or reset their connections, and update vulnerable runtime and documentation dependencies for the next release.

Why

Request-validation and connection errors could stop the daemon before authentication. The runtime and documentation lockfiles also contained dependencies with published security advisories.

How

• Validate the JSON-RPC envelope before dispatch and authenticate shutdown before allowing its handler failures to stop the daemon. Handle Unicode tokens, invalid JSON structures, deeply nested JSON and socket resets without losing the server.
• Require Pillow 13.0.0 and Python 3.11 or newer; update the Python lockfile, CI matrix, packaging, AUR requirements and migration documentation. This is a compatibility change for Python 3.10 installations.
• Upgrade the static documentation toolchain to Astro 7, retaining Tailwind 3 through PostCSS. Pin the patched locked dependencies and use Node 24 in documentation CI.
• Require the dependency-audit job to pass before the release job can publish.

Test plan

• Demonstrated daemon regression tests failing before the fixes and passing afterward, including real isolated TCP subprocess tests and successful authenticated shutdown.
• pixi run check: 3,096 passed, 6 skipped; 92.35% coverage; Ruff and mypy clean.
• Minimum supported Python 3.11: complete suite passed; connection-reset regression also passed.
• Clean docs install, build and validation: 407 passed.
• Python and documentation lockfile scans: zero remaining known advisory matches across 351 distinct package versions. pip-audit and npm audit also clean.
• Lockfile, generated-reference freshness and AUR shell-syntax checks passed.
• GitHub Linux/Windows matrix and wheel/sdist verification passed on Python 3.11, 3.12 and 3.14: https://github.com/BANANASJIM/rdc-cli/actions/runs/40030108062
• macOS tests and published artifact verification passed in the v0.7.0 release workflow. Fresh Python 3.11 installation from PyPI succeeds; wheel and sdist hashes match CI artifacts.

Local GPU smoke testing was attempted in an isolated session: 7 checks passed, while replay-dependent checks could not run because the tracked NVIDIA capture is incompatible with the available AMD RX 7600. The pre-push hook was bypassed using its documented option for this hardware limitation; remote required checks remain enforced.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c7d0d4f3-879e-49e5-b968-ede9f4e57fbf

📥 Commits

Reviewing files that changed from the base of the PR and between 329e64e and 4661db7.

⛔ Files ignored due to path filters: 2

• docs-astro/package-lock.json is excluded by !**/package-lock.json
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing: 15

• .github/workflows/ci.yml
• .github/workflows/docs.yml
• CONTRIBUTING.md
• README.md
• aur/PKGBUILD
• aur/stable/PKGBUILD
• docs-astro/astro.config.mjs
• docs-astro/package.json
• docs-astro/postcss.config.mjs
• docs-astro/src/pages/docs/install.astro
• mypy.ini
• pyproject.toml
• src/rdc/daemon_server.py
• tests/unit/test_daemon_server_unit.py
• tests/unit/test_daemon_transport.py

+-------------------------------------------------------------------------------------------------------+
| Make it easy to reuse. If it's easy to reuse, people will. Create an environment that supports reuse. |
+-------------------------------------------------------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}