This new rule says ../ is banned in every file, but it remains in tests/entrypoints.test.ts, tests/workflow.test.ts, and src/run.ts; the listed import rule does not check URL strings. Remove those traversals or narrow and enforce the rule to match its actual scope.
AGENTS.md says every test imports #testing, but src/credentials.test.ts, src/opencode.test.ts, and src/profiles.test.ts do not. Limit this to tests/ (or make the statement true) so the alias policy stays accurate.
AI bot failed.
Profile: none · all profiles failed
The stage counter always starts at zero, so another FTP client can create this known name after MLST but before STOR. STOR can then truncate that client's file and cleanup can delete it. Use an unguessable suffix and add a collision regression.
A data write can fail after the server accepted a prefix. Clearing the socket makes Drop skip its cleanup, so that partial remote file remains, violating the writer contract. Stage uploads under a temporary name and promote only after a confirmed completion, or otherwise ensure cleanup before exposing the target.
An upload data-write failure returns OutcomeUnknown but leaves CONTROL cached. The server may still be awaiting this transfer's completion, so a later operation can send NOOP or a mutation on a desynchronized session. Clear the control slot when this error (or a zero-byte write) occurs, and add a regression that proves the next operation reconnects rather than reusing it.