AntFleet

Disagreement · 8ff8c1af-openai-0

Telemetry ‘global updated_at’ logic does nothing when metrics table is empty (watchers never see changes)

mismatch
repo 56f59a0d·PR #2·reviewed 4 days ago

Primary finding

Telemetry ‘global updated_at’ logic does nothing when metrics table is empty (watchers never see changes)

mediumbughigh
  • src/providers/telemetry.ts:161-165
When there are no rows in provider_metrics, the UPDATE affects 0 rows. The intent (comment) is to bump a global heartbeat so UI watch mode sees a change via MAX(updated_at), but with an empty table nothing changes, so getLastUpdatedTime continues to return 0 and watchers never update despite decisions/failures being recorded.

Recommendation

Implement a real heartbeat separate from per-provider metrics. Options: - Add a small meta table: CREATE TABLE IF NOT EXISTS meta (k TEXT PRIMARY KEY, v INTEGER NOT NULL); and upsert meta('last_updated', now) on every flush. - Or insert/update a dedicated sentinel row in provider_metrics (e.g., id='__heartbeat__') with ON CONFLICT(id) DO UPDATE SET updated_at=excluded.updated_at to guarantee at least one row exists. Prefer the meta table to avoid corrupting per-provider updated_at semantics.

Counterpart finding

Telemetry uses string interpolation for ${RETENTION_LIMIT} and ${now} in SQL — not a vuln here but a footgun

lowmaintainabilityhigh
  • src/providers/telemetry.ts:170-172
  • src/providers/telemetry.ts:209-218
Both values are currently safe (number constants), but mixing exec() string interpolation with prepare()/run() bind parameters elsewhere is inconsistent and invites future injection bugs if these constants ever become user-configurable.

Recommendation

Use prepared statements with bind parameters consistently.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.