[pablopfg]

Requested by Pablo · project thread

Plan, phase 1, PR 3. This closes what was left of AGT-04, and also AGT-07, AGT-08 and AGT-09 from the handoff audit.

Changes

• AGT-04 (backup import). Keep newer local edits to tasks, notes and projects when importing a backup rociiu/talorys#96 made "newer copy wins". But a forged date such as 9999-… still beat every later local edit.
  • Any date that can't be read, or that is more than 5 minutes in the future, is stored as the import time. It never replaces an existing task, note, project or memory.
  • The import route now reads at most 10 MB, down from 25 MB. Each kind of record has a cap (MAX_IMPORT_RECORDS). A backup over either limit is refused whole: nothing is imported.
  • The web upload check is now 10 MB too.
• AGT-07 (budget day).
  • UsageService counts the day in the owner's timezone, read from settings. Before, the budget reset at UTC midnight, which is 21:00 in Brasília. An unusable timezone falls back to UTC.
  • Semantic recall's own embedding caps still use the static UTC day.
  • Tool calls from a chat turn or scheduled run that fails now count toward the day (finally).
• AGT-08 (logs). Workers AI and chat-turn failures log only errorSummary: the error name plus any 3–4 digit code. The message can quote a prompt or a note, so it is no longer logged.
• AGT-09 (update check). The npm update check now starts off on new installations. The docs say how to turn it on.
• I updated the changelog (Alterado and Segurança) and docs/security.md, and added the pt-BR text for the new error.

Tests

• npm run lint, typecheck, build and npm test all pass (879 tests).
• There are 9 new tests in apps/agent/test/import-and-budget.test.ts:
  • a forged future date, then a local edit, then the same file imported again;
  • unreadable dates;
  • the record cap, which imports nothing;
  • the day in São Paulo and in Tokyo;
  • the fallback for an invalid timezone;
  • tool calls counted on a failed turn;
  • errorSummary.
• update-check.test.ts now turns the check on where it needs it, and has a test that it starts off.

Upgrading

No migration. Existing installs keep their saved update-check setting.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cfe7123a-3b26-409a-b24d-2e437b1cf071

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}