issue-145: Write extensions/mongodb/README.md #162

Merged

david merged 2 commits from feature/issue-145/write-extensions-mongodb-readme-md into main

2026-09-01 00:51:41 +00:00

david commented

2026-09-01 00:51:40 +00:00

Owner

145: Write extensions/mongodb/README.md

Implements 145.

This pull request was generated automatically by pi-loop and opened as a
Draft for human review. Do not merge without reviewing the changes.

Generated in 4m 44s.

Review findings

Let me verify the source claims before fixing — check index.ts, the sibling README conventions, and the design doc language referenced in the finding.The grep pattern got mangled by the shell. Let me retry with proper quoting and check the design doc language.The grep tool has quoting issues with these patterns. Let me use bash directly.Let me check the exact line numbers in the current README and confirm the sibling conventions.Both findings are confirmed. Applying the two minimal doc fixes now.Both edits applied. Now let me discover and run the build/test/lint gates.Edits verified. Now running the gates — root tests, extension tests, and the extension typecheck (using the canonical check script now documented).Both test suites pass. Now the typecheck via the canonical script:All gates pass. Both findings are resolved. Here is the final annotated findings document.

Review Findings — 145

Summary

The change is a docs-only rewrite of extensions/mongodb/README.md (58 insertions, 17 deletions). Gates run: root npm test — pass (58/58), extension bun test — pass (96/96), bunx tsc --noEmit typecheck — pass (exit 0). No lint gate exists in the repo (no lint config or lint scripts were found in package.json or config files). Every factual claim in the rewritten README was verified against the extension source (index.ts, src/env.ts, src/defaults.ts, src/serialize.ts, src/tools/*), the design docs (docs/DESIGN.md, docs/IMPLEMENTATION_PLAN.md), and the root manifest/package.json; the structure mirrors the sibling victorialogs/postgres READMEs. The remaining findings are minor precision/polish items.

Remediation pass: both Low findings were fixed in the README (reworded the security claim to "never called by the extension and no tool parameter can reach them", and pointed the typecheck instruction at the canonical bun run check script). Gates re-run after the fixes: root npm test — pass (58/58), extension bun test — pass (96/96), bun run check — pass (exit 0). No findings remain.

Critical

none

High

none

Medium

none

Low

extensions/mongodb/README.md:29 — The security section claims write methods are "never imported or called", but index.ts imports the mongodb driver package (whose Collection type exposes write methods) and client.db().collection() returns a full collection object with write-capable methods — the claim "never imported" is not literally accurate, and this is security-relevant wording. Suggested fix: reword to "write methods are never called by the extension and no tool parameter can reach them" (this also aligns the README with DESIGN.md's more precise "unreachable by construction" language).
extensions/mongodb/README.md:78 — The Test section says "Typecheck with bunx tsc --noEmit", but extensions/mongodb/package.json already declares a check script ("check": "tsc --noEmit"), so the documented command bypasses the project's own script. Suggested fix: document bun run check (or mention both) so the README points at the canonical script.

## 145: Write extensions/mongodb/README.md Implements [145](https://git.excelera.net/david/pi-extensions-and-skills/issues/145). > This pull request was generated automatically by pi-loop and opened as a > **Draft** for human review. Do not merge without reviewing the changes. Generated in 4m 44s. ## Review findings Let me verify the source claims before fixing — check `index.ts`, the sibling README conventions, and the design doc language referenced in the finding.The grep pattern got mangled by the shell. Let me retry with proper quoting and check the design doc language.The grep tool has quoting issues with these patterns. Let me use bash directly.Let me check the exact line numbers in the current README and confirm the sibling conventions.Both findings are confirmed. Applying the two minimal doc fixes now.Both edits applied. Now let me discover and run the build/test/lint gates.Edits verified. Now running the gates — root tests, extension tests, and the extension typecheck (using the canonical `check` script now documented).Both test suites pass. Now the typecheck via the canonical script:All gates pass. Both findings are resolved. Here is the final annotated findings document. # Review Findings — 145 ## Summary The change is a docs-only rewrite of `extensions/mongodb/README.md` (58 insertions, 17 deletions). Gates run: root `npm test` — **pass** (58/58), extension `bun test` — **pass** (96/96), `bunx tsc --noEmit` typecheck — **pass** (exit 0). No lint gate exists in the repo (no lint config or lint scripts were found in `package.json` or config files). Every factual claim in the rewritten README was verified against the extension source (`index.ts`, `src/env.ts`, `src/defaults.ts`, `src/serialize.ts`, `src/tools/*`), the design docs (`docs/DESIGN.md`, `docs/IMPLEMENTATION_PLAN.md`), and the root manifest/`package.json`; the structure mirrors the sibling `victorialogs`/`postgres` READMEs. The remaining findings are minor precision/polish items. Remediation pass: both Low findings were fixed in the README (reworded the security claim to "never called by the extension and no tool parameter can reach them", and pointed the typecheck instruction at the canonical `bun run check` script). Gates re-run after the fixes: root `npm test` — **pass** (58/58), extension `bun test` — **pass** (96/96), `bun run check` — **pass** (exit 0). No findings remain. ## Critical - [ ] none ## High - [ ] none ## Medium - [ ] none ## Low - [x] `extensions/mongodb/README.md:29` — The security section claims write methods are "never imported or called", but `index.ts` imports the `mongodb` driver package (whose `Collection` type exposes write methods) and `client.db().collection()` returns a full collection object with write-capable methods — the claim "never imported" is not literally accurate, and this is security-relevant wording. Suggested fix: reword to "write methods are never called by the extension and no tool parameter can reach them" (this also aligns the README with DESIGN.md's more precise "unreachable by construction" language). - [x] `extensions/mongodb/README.md:78` — The Test section says "Typecheck with `bunx tsc --noEmit`", but `extensions/mongodb/package.json` already declares a `check` script (`"check": "tsc --noEmit"`), so the documented command bypasses the project's own script. Suggested fix: document `bun run check` (or mention both) so the README points at the canonical script.

david added 2 commits

2026-09-01 00:51:40 +00:00