Help Wanted

AI Summary: This issue is a beginner-friendly task to add a new Japanese grammar point, "〜ば〜ほど" (the more... the more...), to a JSON file. It requires no coding and can be completed directly in the browser by starring, forking, editing the JSON, and submitting a pull request.

AI Summary: A race condition occurs when running `turbo run build test` locally. The `@expressots/cli` build script deletes the `bin/` directory before the test script, which spawns `bin/cli.js`, has a chance to execute, leading to "Cannot find module" errors. This issue does not affect CI as build and test are run as separate steps.

AI Summary: This issue is a beginner-friendly task to add a new trivia question about Japanese terms to a JSON file. No coding is required, and the contribution can be made directly through the browser in under a minute. It's labeled as a 'Good First Issue' and is suitable for Hacktoberfest.

AI Summary: The `worst_case` calculation in LangGraph's admission system incorrectly under-counts iterations for acyclic plans. This leads to rounds being admitted based on an inaccurate estimate, causing nodes to execute and the budget to be exceeded before the round is discarded. The issue impacts iteration, token, and second budgets, undermining the admission system's core promise of preventing execution of over-budget proposals.

AI Summary: When a synchronous node in the runtime is interrupted with Ctrl-C (KeyboardInterrupt), it fails to record an 'error' event in the trace, unlike its asynchronous counterpart. This prevents proper auditing of interrupted runs, as the trace simply ends without explanation and the error count remains zero. The fix involves changing the exception handling in the sync wrapper to match the async wrapper's behavior, ensuring all exceptions, including KeyboardInterrupt and SystemExit, are logged.

AI Summary: The `/live` endpoint in the server incorrectly lists and parses trace files that are symlinked from outside the designated live root directory. While the server's reader correctly refuses to serve these external files, the index exposes their metadata and run IDs, creating a potential information leak. The fix should involve applying the same confinement logic used by the reader to the trace scanning process.

AI Summary: The `invoke` and `stream` entry points for LangGraph silently drop unknown input keys, leading to unexpected behavior and masking errors. This contrasts with `update_state`, which correctly raises an error for unknown keys. The issue proposes validating input keys against the state schema at the entry points to ensure consistent error handling.

AI Summary: This issue describes two vulnerabilities in the fan-out mechanism of GraphARC. First, the `input_schema` validation is bypassed for `Send` payloads, allowing incorrect data types to be passed to workers. Second, mutable dictionary payloads are not deep-copied, leading to shared state and data races between parallel workers.

AI Summary: The `OnsetEnum` in the schema is missing a generic 'ADULT' value, which is the parent of existing adult onset categories. This prevents accurate modeling of diseases reported with qualitative 'adult onset' without a specific decade, forcing curators to choose an arbitrary sub-category or leave the field unset.

AI Summary: Policies that define rules for the 'node' resource are silently ignored by the Grapharc engine. The code responsible for checking node-kind policies is not called at runtime, leading to a 'fail-open' scenario where denied node actions are still permitted. This is a critical bug as it undermines the security and control intended by the policy system, especially since example policies also include node rules.

AI Summary: An unauthenticated request with a non-ASCII token to the `/live` endpoint causes a server crash (500 error) instead of a proper authentication failure (401). This occurs because the token comparison function `secrets.compare_digest` raises a `TypeError` when encountering non-ASCII characters, and this exception is not handled. The fix involves encoding the tokens to bytes before comparison to maintain security and prevent crashes.

AI Summary: The `expressots new` command crashes with a `RangeError` after successfully scaffolding a project when the terminal width is too narrow to display the success banner. This is caused by the `centerText` utility function attempting to repeat a string with a negative padding value when the terminal is narrower than the banner text.

AI Summary: Regular files (non-markdown) are indexed with a NULL permalink because the computed permalink is discarded before entity creation. This creates a latent consistency issue, as consumers of permalinks must treat them as optional, potentially leading to future bugs. The suggested fix is to assign the resolved permalink during indexing and audit for similar patterns.

AI Summary: A NUL byte in a user-provided path causes an uncaught `ValueError` in the Slack command handler, leading to silence instead of a refusal. The issue also notes a minor bug where single-dash tokens are incorrectly treated as positional arguments. The fix involves catching the `ValueError` and raising a `SlackCommandError`, and ensuring single-dash tokens are handled correctly.

AI Summary: Four CLI commands (trace, metrics, viz, run) incorrectly exit with code 1 and print raw tracebacks when encountering unreadable input files. The expected behavior is to exit with code 2 and output a JSON document indicating an error, as documented in the README and demonstrated by the 'replay' command. This inconsistency arises from insufficient exception handling for various file-related errors like `IsADirectoryError`, `PermissionError`, and `UnicodeDecodeError`.

AI Summary: The `grapharc plan --approve --json` command incorrectly prints a human-readable waiting message to stdout before the JSON output, making it unparseable by machines. This issue affects unattended script usage where the output is consumed programmatically. The fix involves either guarding the message with a `--json` check or moving the approval information into the JSON document itself.

AI Summary: The Slack command parser incorrectly handles repeated `--registry` flags. When the flag is provided twice, the parser uses the first occurrence for validation, but the command execution uses the last occurrence. This bypasses crucial security checks designed to prevent the execution of potentially risky agent tools without explicit user approval.

AI Summary: The Windows CI environment is experiencing significantly longer test execution times compared to Linux and macOS, and even local Windows machines. The user suspects an environmental or configuration issue within the CI setup and has linked a previous attempt to fix it.

AI Summary: The inline code `cursor-agent login` within the warning banner is difficult to read due to low contrast and lack of visual separation from the surrounding text and background. This impacts accessibility and the ability for users to easily identify the actionable command.

AI Summary: When a node in a run is interrupted due to exceeding a budget (like max_tokens), it emits an 'error' event instead of an 'end' event. The 'error' event does not carry token counts, causing the tokens spent by that interrupted node to be lost from the audit trail. This leads to runs that are stopped for overspending reporting zero tokens spent, which is misleading and problematic for cost auditing.