Dezső BICZÓ mxr576

1. Authority Hierarchy & Extension Boundaries

Platform extensions must state facts, not prescribe workflows: Container, harness, and platform extensions should only declare runtime mechanics (e.g. environment variables available, paths preserved, proxy shims active). They must never inject prescriptive operational rules or command syntax into the base system prompt.
System prompts overpower local steering: Directives placed in the system prompt carry maximum architectural weight. When an extension mandates a specific command syntax at the system level, it creates an authoritative constraint that actively suppresses project-level steering and skill discovery.

2. Information Hierarchy & Model Pretraining Gravity

Pretraining bias requires zero-hop execution: When a tool competes against a behavior deeply ingrained in a model's pretraining, that tool cannot live exclusively on Rung 3 (disclosed reference behind a skill pointer). Expecting an agent to stop, inhibit its reflex, and

Role: You are an expert TypeScript Software Engineer, Application Security Specialist, and an authority on the Pi Coding Agent extension ecosystem. Your role is to perform thorough, critical, and constructive code reviews on Pi extension code (TypeScript modules utilizing @earendil-works/pi-coding-agent).

Objective: Analyze the TypeScript extension source code provided in the {{EXTENSION_INPUT}} placeholder at the bottom of this prompt. This input may contain raw code, a local file path, or a 3rd-party extension package. Evaluate it thoroughly for critical security flaws, type-safety leaks, incorrect Pi Extension API usage, and performance issues. Provide actionable feedback and refactored code examples where necessary.

Key Areas of Focus:

Security & Permissions (Priority: CRITICAL)

System Access: Pi extensions run with full system permissions. Identify any dangerous or unvalidated execution of system commands (e.g., bypassing ctx.ui.confirm before executing rm -rf or sudo).

Symfony security advisories — May 20, 2026

All CVEs shipped in the coordinated release of v5.4.x / v6.4.40 / v7.4.12 / v8.0.12 on May 20, 2026. CVE numbers and descriptions are sourced from the v8.0.12 release notes. SA links are sourced from the Symfony security advisories blog.

CVE	Component	Impact	SA report	Fix commit	Branches
CVE-2026-46626	[Runtime]	CVE-2024-50340 patch bypass: web requests can still set `APP_ENV`/`APP_DEBUG` via `parse_str`/SAPI argv mismatch	SA	3228c3806e	5.4+
CVE-2026-47212	[Notifier/Twilio]	Twilio webhook parser never verifies the X-Twilio-Signature HMAC: unauthentica

Your role is to help create clear, well-structured issue descriptions for Drupal.org that follow community standards for both Drupal core and contributed projects.

Instructions

1. Template usage

If no issue title is provided, suggest one or up to three alternatives.
If the user provides an HTML template, use it exactly as provided, with no structural, markup, or attribute changes (including id, class, and data-* attributes).
Do not change heading levels or strip/add attributes on user-provided headings.
If no template is provided, apply the default Drupal issue summary template shown here:

You are an expert bash script developer. Create cross-platform bash scripts that work reliably on WSL, Ubuntu Linux, and macOS while following Google's Shell Style Guide (https://google.github.io/styleguide/shellguide.html).

Core requirements

Essential script structure:

#!/usr/bin/env bash
set -eou pipefail
if [[ -n "${DEBUG:-}" ]]; then
 set -x

Composer project template that speeds up contribution to Apigee Edge Drupal module and Apigee API client PHP library.

Steps

Pick composer.json
Fork these components on Github.
Change CHANGE_ME strings in repository urls to your Github user name.
Run composer install

You get these components installed from version control. After that you can follow the regular GitHub PR workflow.

	<?php

	/**
	* @file
	* Mass-exports Drupal nodes to Markdown files using the Markdownify module.
	*
	* DESCRIPTION:
	* This Drush script is designed for the mass-export of nodes into Markdown
	* (.md) files. It is optimized to handle a large number of nodes (10,000+)
	* efficiently by processing them in configurable chunks to prevent out-of-memory

	{
	"name": "mxr576/drupal-ai-providers",
	"description": "Downloads a collection of Drupal AI provider modules. Intended for exploring provider implementations or refactoring the AI core module. WARNING: This setup creates a non-functioning project.",
	"type": "metapackage",
	"repositories": [
	{
	"type": "composer",
	"url": "https://packages.drupal.org/8"
	}
	],

	<h3 id="summary-problem-motivation">Problem/Motivation</h3>
	(Why the issue was filed, steps to reproduce the problem, etc.)

	<h4 id="summary-steps-reproduce">Steps to reproduce</h4>
	(Detailed instructions on how to reproduce the issue, including exact versions used, specific paths to visit, what actions to take, etc.)

	<h3 id="summary-proposed-resolution">Proposed resolution</h3>
	(Description of the proposed solution, the rationale behind it, and workarounds for people who cannot use the patch.)

	<h3 id="summary-remaining-tasks">Remaining tasks</h3>

	################################################################################
	# DDQG Composer Audit Docker image with Composer Audit Changes plugin.
	#
	# Usage:
	# - docker buildx build --tag mxr576/ddqg_composer_audit:latest .
	# - docker run --rm -ti -v [PATH_TO_COMPOSER_PROJECT_ROOT]:/app -v ${COMPOSER_HOME:-$HOME/.composer}/cache:/tmp/composer/cache mxr576/ddqg_composer_audit:latest audit -d /app 2>/dev/null # Ignore STDERR that contains the #StandWithUkraine message and leads to malformed JSON output
	#
	# See further ideas at https://hub.docker.com/r/composer/composer
	#
	# Simplified and customized version of https://github.com/composer/docker/blob/fd5f23e4881cad1f4a3f4249dd2120a8788fb2d9/latest/Dockerfile