fix(ops): make operator export scripts honor --help and refuse out-of-repo output paths - #55
fix(ops): make operator export scripts honor --help and refuse out-of-repo output paths#55nish3451 wants to merge 2 commits into
Conversation
…-repo output paths Every active operator export script now handles --help/-h before doing any work: it prints usage and exits 0 without writing or overwriting any cockpit or mission artifact. Operator-supplied output paths (--output, --html, --ops, --loom-links) are resolved against the service repository root and refused when they escape it via absolute paths, .. traversal, or symlinks -- including dangling symlinks whose target writeFileSync would silently create outside the repo -- so an export can no longer write or overwrite files anywhere. - Add scripts/lib/operator-cli.mjs with handleHelp() and resolveOutputPath() - Wire both into all 21 npm-script-backed export scripts; validate every output path before any dependency exporter runs or any artifact is written - Route the internal-dashboard parity scratch inside the repo (unique runs/ path, cleaned up in finally) instead of /tmp - Extend test-active-operator-surfaces.mjs: --help and -h contract for every active export script (exit 0 + usage + untouched artifacts), escape probes confined to a test-owned tmp directory, and symlink/dangling-symlink refusal probes
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (23)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5416994af7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| } | ||
| } | ||
| return resolved; |
There was a problem hiding this comment.
When an export uses either its default path or a relative output flag, this return value converts the path to an absolute host-specific path, and callers then serialize it directly (for example, export-recording-queue.mjs returns it as path, while prepare-recording-batch.mjs propagates that value and export-internal-dashboard.mjs embeds dependent exporters' paths in generated documents). This breaks the existing repository-relative CLI result contract and leaks checkout-specific prefixes into operator output; retain the raw repository-relative path for reporting while using the resolved path only for filesystem operations.
Useful? React with 👍 / 👎.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
The fleet keeps dispatching the same finding to multiple lanes, producing duplicate same-fix PR pairs: #36/#44 and #55/#56 are byte-identical or near-identical patches of the operator export --help fix, #39/#49 the offername article fix, #40/#52 the recording exporter --help fix, plus #38/#48/#51, #30/#61/#72, #45/#64, #42/#60, #43/#54 and #46/#74. Add a PR Duplicate Guard: - scripts/check-pr-duplicates.mjs compares a PR's diff against every other open PR (shared changed-file coverage >= 0.8 and patch similarity >= 0.5). Calibrated on all 79 open PRs on 2026-08-11: every pair above the thresholds was a genuine duplicate-cluster member, zero false positives. - .github/workflows/pr-duplicate-guard.yml runs it on every PR event and posts one marker comment naming the duplicate(s) and the canonical PR; the check fails loudly when a duplicate is found. Informational, not required. - scripts/test-pr-duplicates.mjs covers parsing, similarity, detection, and comment upsert with an injected API; wired into npm ci and npm test.
|
Correction to my closing comment above: the keeper for this cluster is #160, not #56. I had wrongly concluded that This PR stays closed either way — its content is superseded by what is already on |
1 participant
What
Closes the operator-export CLI safety gap: export scripts ignored
--helpandaccepted
--output/--html/--ops/--loom-linkspaths that could write oroverwrite cockpits, missions, and other files anywhere on the machine.
Repro against origin/main:
node scripts/export-growth-metrics.mjs --helpexits 0 while silently regenerating and overwriting the tracked
growth-brain/ops/live-metrics.md, andnode scripts/export-daily-money-mission.mjs --output=/tmp/escape.mdwritesoutside the repository.
Changes
scripts/lib/operator-cli.mjshandleHelp(args, usage)— prints usage and exits 0 before any work when--help/-his present.resolveOutputPath(value, {flag, fallback})— resolves operator-suppliedoutput paths against the service repository root and refuses paths that
escape it via absolute paths,
..traversal, or symlinks. Component-wiselstatSyncchecks catch live symlink escapes and dangling symlinks(whose target
writeFileSyncwould silently create outside the repo).validated before any dependency exporter runs or any artifact is written;
parent dirs derive from
dirname()instead ofsplit("/").export-internal-dashboardno longer writes its parity scratch file to/tmp; it uses a unique, gitignoredruns/path cleaned up infinally.export-market-benchmarkreports operator-facing relative paths in itsJSON output so the tracked market-parity-readiness artifact content is
unchanged.
test-active-operator-surfaces.mjs: every active export scriptmust exit 0 on
--helpand-h, print usage, and leave tracked + privateartifacts untouched; escaping
--output/--html/--ops/--loom-linksprobes (confined to a test-owned tmp dir), a live-symlink escape, and a
dangling-symlink escape are all refused without creating files.
Validation
npm testpasses end to end (all suites, including tracked-artifactbyte-identical regeneration checks).