flake improvements

[imalsogreg]

fix up compiled library for non-nix systems

flake musl

baml-runtime package

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
promptfiddle	Ready	Preview	Comment	Oct 6, 2025 5:59am

[entelligence-ai-pr-reviews]

🔒 Entelligence AI Vulnerability Scanner

✅ No security vulnerabilities found!

Your code passed our comprehensive security analysis.

---

[entelligence-ai-pr-reviews]

Review Summary

🏷️ Draft Comments (2)

Skipped posting 2 draft comments that were valid but scored below your review threshold (>=10/15). Feel free to update them here.

engine/language_client_typescript/build.rs (2)

48-48: napi_build::setup() is always called, even if the custom symlink logic runs, which may cause duplicate or conflicting build steps on systems where the env vars are set.

📊 Impact Scores:

• Production Impact: 3/5
• Fix Specificity: 2/5
• Urgency Impact: 2/5
• Total Score: 7/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In engine/language_client_typescript/build.rs, on line 48, the unconditional call to `napi_build::setup()` means it runs even when the custom symlink logic (lines 11-46) is executed, potentially causing duplicate/conflicting build steps. Refactor the code so that `napi_build::setup()` is only called if the custom env var logic does NOT run (i.e., in the else branch).

---

11-46: tmp_path, pkg_name, and out_dir are taken directly from environment variables and used in filesystem operations without validation, allowing path traversal or symlink attacks if an attacker controls these env vars.

📊 Impact Scores:

• Production Impact: 3/5
• Fix Specificity: 2/5
• Urgency Impact: 3/5
• Total Score: 8/15

🤖 AI Agent Prompt (Copy & Paste Ready):

In engine/language_client_typescript/build.rs, lines 11-46, environment variables `TYPE_DEF_TMP_PATH`, `CARGO_PKG_NAME`, and `OUT_DIR` are used directly in filesystem operations, which could allow path traversal or symlink attacks if an attacker controls these env vars. Add validation to ensure these variables do not contain `..`, absolute paths, or path separators before using them. If validation fails, panic with an error. Apply the fix to the relevant block.

---

[entelligence-ai-pr-reviews]

correctness: pkgs.python3Packages.buildPythonPackage uses a dynamic wheel filename, but src is set using builtins.head (builtins.attrNames (builtins.readDir wheelDir)), which is non-deterministic and may select the wrong file if multiple wheels exist, causing incorrect or failed builds.

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

In flake.nix, lines 346-349, the code for setting the wheel file for the Python package uses 'builtins.head (builtins.attrNames (builtins.readDir wheelDir))', which is non-deterministic and may select the wrong file if multiple files exist. Update this logic to filter for files ending with '.whl' and throw an error if none are found, ensuring the correct wheel is always used. Replace the snippet with the following:
src = let
  wheelDir = "${packages.pyLib}/lib";
  wheelFiles = builtins.filter (n: pkgs.lib.hasSuffix ".whl" n) (builtins.attrNames (builtins.readDir wheelDir));
  wheelFile = if wheelFiles == [] then throw "No wheel file found in ${wheelDir}" else builtins.head wheelFiles;
in "${wheelDir}/${wheelFile}";

📝 Committable Code Suggestion

‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.

Suggested change

	src = let
	wheelDir = "${packages.pyLib}/lib";
	wheelFile = builtins.head (builtins.attrNames (builtins.readDir wheelDir));
	in "${wheelDir}/${wheelFile}";
	src = let
	wheelDir = "${packages.pyLib}/lib";
	wheelFiles = builtins.filter (n: pkgs.lib.hasSuffix ".whl" n) (builtins.attrNames (builtins.readDir wheelDir));
	wheelFile = if wheelFiles == [] then throw "No wheel file found in ${wheelDir}" else builtins.head wheelFiles;
	in "${wheelDir}/${wheelFile}";

[github-actions]

🌿 Preview your docs: https://boundary-preview-e3475152-a82d-474e-93f7-9b50f6bf3cb7.docs.buildwithfern.com

[github-actions]

🌿 Preview your docs: https://boundary-preview-6898798e-3866-4179-b284-d4a8a4e6e6ee.docs.buildwithfern.com

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

https://sage-backend-64gvr3t9l-baml.vercel.app