Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 47-56: The go.work generation writes an invalid version directive
"go 1.25.5"; update the version line emitted by the CI step that writes go.work
so it uses a valid major.minor Go directive (e.g., "go 1.23" or whatever the
project's supported Go version is) instead of a patch-level value, ensuring the
echoed line that currently outputs `go 1.25.5` is replaced with the correct `go
X.Y` string.
- Around line 13-45: Replace all tag references for actions (the uses: entries
for actions/checkout@v4 and actions/setup-go@v5) with their specific commit SHAs
and add persist-credentials: false to every checkout step; update the steps
named "Checkout hyperrr", "Checkout mdk", "Checkout auth", "Checkout commerce",
and "Checkout file-storage" to include persist-credentials: false under their
with: blocks and change uses: actions/checkout@v4 to uses:
actions/checkout@<COMMIT_SHA>, and change "Setup Go" uses: actions/setup-go@v5
to uses: actions/setup-go@<COMMIT_SHA> (replace <COMMIT_SHA> with the verified
commit hashes).

In `@api/mcp/server.go`:
- Around line 928-954: The product currency is hardcoded to "USD" when rendering
the row; update the rendering to use the product's actual currency by replacing
the literal "USD" with the product or variant currency: check if p has a
Currency field (use p.Currency), otherwise fall back to the first variant's
currency (p.Variants[0].Currency); if variants may have mixed currencies, detect
that while iterating (compare each v.Currency) and show a sensible value like
"Multiple" or the first variant currency as a fallback; update the fmt.Sprintf
call that builds the row (references: p, p.Variants, priceStr, fmt.Sprintf) to
use that resolved currency variable instead of "USD".

In `@go.mod`:
- Line 74: Update the indirect dependency entry for golang.org/x/crypto in
go.mod from v0.51.0 to v0.52.0 (or newer) to resolve the SSH-related OSV
findings; locate the golang.org/x/crypto line in go.mod and change the version,
then run `go get golang.org/x/crypto@v0.52.0` (or `go get
golang.org/x/crypto@latest`) and `go mod tidy` followed by re-running the OSV
scan to verify the vulnerabilities are cleared.

In `@internal/builder/codegen.go`:
- Line 600: The nil-generation branch in internal/builder/codegen.go treats
"mdk.Actor" as nil (inside the if that checks strings.HasPrefix(part, "*") ||
strings.HasPrefix(part, "[]") || strings.HasPrefix(part, "map[") || part ==
"mdk.Actor"), which is wrong because mdk.Actor is a struct; update the logic
that builds zeroVals so that "mdk.Actor" is not classified as nil-able and
instead produces its struct zero-value (e.g., "mdk.Actor{}") when appending to
zeroVals; keep pointer, slice and map handling the same and only special-case
mdk.Actor to emit the struct literal.

In `@internal/storage/cloud.go`:
- Around line 69-72: The code currently buffers the entire incoming reader by
calling io.ReadAll(data) into buf which risks high memory usage; change the
filesystem storage path in internal/storage/cloud.go to stream the io.Reader
directly to disk instead of reading it into memory—create/open the destination
file (e.g., via os.Create or similar used in this module) and use io.Copy (or
io.CopyBuffer) to copy from the incoming data reader into the file, propagate
and handle any copy errors, and ensure the destination file is properly closed
and cleaned up on failure; replace the io.ReadAll + buf usage with this
streaming approach referencing the existing data variable and the file write
logic in this file.
- Line 132: Replace the naive fmt.Sprintf("%s/%s", strings.TrimSuffix(p.url,
"/"), path) with proper URL construction: parse p.url with net/url (url.Parse),
normalize the incoming path by converting OS separators with
filepath.ToSlash(path) for file:// on Windows, join URL paths with path.Join
(from package path) using the parsed base URL's Path, set the joined value into
the parsed url's Path (which will be correctly escaped) or use
url.ResolveReference, and return parsedURL.String(); update imports to include
net/url, path and filepath and remove the current string-concatenation logic
that produces duplicate slashes and misses encoding.

---

Outside diff comments:
In `@api/graph/api_test.go`:
- Around line 212-217: Update the test comment to accurately describe the
failing input: it currently says "missing name" but the call to
resolver.Mutation().CreateProduct uses product.CreateProductInput{ID: "fail",
Handle: ""}, which omits both Name and Handle; change the comment to state that
the test ensures creation fails when Name and Handle are missing/empty (or
whichever precise combination you're asserting) so it matches the input used by
the CreateProduct call in the test.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Line 9: Move the "tone_instructions" entry out of any nested map (e.g.,
reviews) and place it as a top-level key named exactly "tone_instructions" in
.coderabbit.yaml so CodeRabbit can read it; verify there is only one top-level
"tone_instructions" string (not under "reviews" or another section), and keep
the value as the desired review tone.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/storage/cloud.go`:
- Around line 85-93: The current pattern creates a file with os.Create(fullPath)
and defers f.Close(), but if io.Copy(f, data) fails the incomplete file remains;
change the error path so that when io.Copy returns an error you explicitly close
f (call f.Close()) and remove the partial file with os.Remove(fullPath) before
returning the error; keep the normal defer f.Close() for the success path but
ensure the cleanup (Close + Remove) happens on io.Copy error to avoid leaving
partial files.

---

Outside diff comments:
In `@api/graph/api_test.go`:
- Around line 213-216: The test currently only checks that
resolver.Mutation().CreateProduct(ctx, product.CreateProductInput{ID: "fail",
Handle: ""}) returns an error; update the assertion to verify the error reason
by asserting the error message/content refers to the missing required field
(e.g., "missing name" or "handle is required"). Locate the failing call to
CreateProduct and replace the generic nil-check with an assertion that inspects
err.Error() (or uses errors.Is if a sentinel error is returned) to confirm the
validation message contains the expected substring for required-field validation
on product.CreateProductInput.Handle (and/or name).

In `@internal/storage/cloud.go`:
- Around line 110-114: The file read path concatenation (fullPath :=
filepath.Join(p.baseDir, path); os.Open(fullPath)) is vulnerable to path
traversal; apply the same validation used in Upload: resolve both p.baseDir and
the joined fullPath to absolute paths (or use filepath.Rel) and ensure the
resulting path is within p.baseDir before calling os.Open. If the check fails,
return an error; keep references to the symbols p.baseDir, fullPath, path and
the Upload validation logic to locate and mirror the fix.
- Around line 127-132: The delete routine currently joins p.baseDir with the
user-supplied path and removes it directly, allowing path traversal; update the
deletion logic to perform the same path validation used by Upload and Open:
clean the incoming path, compute the joined fullPath, then verify that the
resolved path is inside p.baseDir (e.g., using filepath.Rel or equivalent)
before calling os.Remove; if the resolved path lies outside p.baseDir return an
error and do not attempt deletion. Ensure you reference the same checks applied
in Upload and Open and protect uses of p.baseDir and fullPath accordingly.
- Around line 80-83: The code uses filepath.Join(p.baseDir, path) to build
fullPath but doesn't validate path traversal; compute the cleaned
absolute/resolved paths (use filepath.Clean + filepath.Abs or filepath.Rel) and
verify that fullPath is inside p.baseDir (e.g., reject when
filepath.Rel(p.baseDir, fullPath) starts with ".." or when the resolved path
does not have p.baseDir as a prefix) before calling os.MkdirAll or writing
files; if the check fails, return an error. Ensure you reference the variables
fullPath, p.baseDir and the incoming path when adding the validation.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 22-23: The workflow currently uses a cross-repo branch expression
"ref: ${{ github.head_ref || github.ref_name }}" (seen next to "path: mdk")
which assumes matching branches exist in dependent repos; change these checkout
actions to use a stable fallback or explicit per-repo ref instead — e.g.,
replace the expression with a conditional that falls back to the repository
default branch (or a repo-specific input/variable) for the mdk checkout, and
apply the same change to the other occurrences (the other "ref: ${{
github.head_ref || github.ref_name }}" lines) so CI no longer fails when feature
branches aren't present in every repo.

In `@api/mcp/server.go`:
- Around line 928-936: The code assigns p.Metadata["currency"] to currencyCode
even when it's an empty string, causing formatPrice output with a trailing
space; update the assignment in the block that checks p.Metadata (around the
currencyCode variable and the p.Metadata["currency"] type assertion) to only set
currencyCode when the asserted string is non-empty (e.g., check curr != "" or
strings.TrimSpace(curr) != "") so that empty metadata values fallback to the
Config/default USD instead of overwriting with an empty string.

---

Duplicate comments:
In @.github/workflows/ci.yml:
- Line 53: The CI step writes an invalid Go workspace directive "go 1.25.5" into
go.work; update the echo that writes go.work so the directive uses major.minor
only (e.g., "go 1.25") instead of "go 1.25.5" — locate the line that outputs the
string "go 1.25.5" to go.work and change it to "go 1.25" (or derive the
major.minor from your GO_VERSION variable) so the go.work file conforms to the
required format.
- Around line 13-47: Replace all tag-pinned action references with their
corresponding commit SHAs and add persist-credentials: false to each checkout
step's with: block; specifically update the uses entries for actions/checkout@v4
in the "Checkout hyperrr", "Checkout mdk", "Checkout auth", "Checkout commerce",
and "Checkout file-storage" steps to the commit SHAs and add
persist-credentials: false under each with:, and also pin actions/setup-go@v5 to
its commit SHA (replace uses: actions/setup-go@v5 with the SHA-pinned ref).