griddynamics/rosetta

Several functions have no callers. src/rosetta-cli/rosetta_cli/rosetta_config.py:286 — save_credentials has no callers anywhere in the repo, only its own docstring example at :295. It writes RAGFLOW_BASE_URL, RAGFLOW_API_KEY, RAGFLOW_DATASET_DEFAULT, RAGFLOW_DATASET_TEMPLATE and ENVIRONMENT into a .env file. Because ENVIRONMENT takes first precedence when the config is next read, this function would persist an inferred value as though the user had declared it. src/rosetta-cli/rosetta_cli/services/document_service.py:29 — list_documents_by_status had exactly one production caller, parse_command.py, which PR #323 removes. src/hooks/src/runtime/throttle.ts:28,51 — makeDebounceStamp and isStampFresh are reachable only from their own tests in src/hooks/tests/runtime/throttle.test.ts. The debounceMs throttle variant that would have used them is removed in PR #323. Separately, in the same area: src/hooks/tests/regression/bundle-isolation.test.ts:27 states that loose-files.js "l

publish-mcp-helm-chart.yml packages and pushes the chart using whatever Chart.yaml version: says, with no check for whether that version is already published. Evidence .github/workflows/publish-mcp-helm-chart.yml:68,74,79 — package and helm push, with no preceding version-exists check. :7-11 — the push trigger's paths list includes the workflow file itself, so a workflow-only edit is enough to publish. Chart version: 0.4.1 was set on 2026-07-16. Two workflow-only edits on 2026-08-19 re-pushed it, and the registry's last-updated timestamp for that chart is 2026-08-19. Consequence Any change under the chart path that does not bump version: overwrites the published chart in place, with no failure and no warning. A consumer pinned to that version receives different content under the same version. The guard already exists in this repo publish-rosetta-cli.yml:49-64,75-85 checks whether the version is already published and handles it explicitly. The Helm workflow has no equivalent. For

hasOverrideToken in src/hooks/src/hooks/read-once-shared.ts:195-202 recursively scans every string value across all of ctx.toolInput for the READ-OVERRIDE token. The structurally similar hasAIReviewedMarker in dangerous-actions/evaluate.ts deliberately restricts its marker search to a per-tool whitelisted field, explicitly to avoid incidental/attacker-influenced content (e.g. a file path containing the substring) triggering the marker. Without the same whitelist here, an unrelated field value could unintentionally suppress read-once dedup. Restrict the scan to the intended field(s), mirroring the dangerous-actions whitelist approach.