fix(health-check): resolve __file__ symlink before computing REPO_DIR#2002
fix(health-check): resolve __file__ symlink before computing REPO_DIR#2002john-the-dev wants to merge 4 commits into
Conversation
**Finding sonichi#2 (agent-api.py):** `validate_twilio_signature` returned True when TWILIO_AUTH_TOKEN was unset, accepting all unauthenticated Twilio webhooks and allowing arbitrary task injection via /twilio/* endpoints. Changed to return False — fail closed — with a 4-test regression suite. **Finding sonichi#5 (skills/x-twitter/x-post.py):** `_require_requests` ran `pip3 install --break-system-packages` as an import side-effect, exposing the install to supply-chain attacks on unpinned packages. Replaced with a clear diagnostic `sys.exit` telling the operator to install the deps explicitly. Both findings confirmed in workspace/notes/security-audit-source-2026-07-06.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QB3qZQrwponfum2JFNvHeh
x-post.py no longer auto-installs requests/requests-oauthlib (removed in the previous commit to eliminate the supply-chain risk from unpinned pip installs). Document the one-time install step in SKILL.md so operators know what to run before first use. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QB3qZQrwponfum2JFNvHeh
Coverage Gate✅ Diff coverage PASSES the 95% bar. Whole-tree (informational): 41%. Diff CoverageDiff: origin/main...HEAD, staged and unstaged changes
Summary
|
When health-check.py is invoked through workspace/src (a symlink to the real src/), Path(__file__).parent.parent resolves through the symlink path and lands in workspace/ instead of the repo root. Caused a spurious ".env missing (workspace/.env)" false-positive on every health-check run. Adding .resolve() before .parent.parent canonicalises the path through the symlink, giving the actual repo root regardless of invocation context. Same fix applied to the sys.path.insert call immediately below for consistency (util_paths.py import must come from the real src/). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QB3qZQrwponfum2JFNvHeh
john-the-dev
force-pushed
the
fix/health-check-repo-dir-symlink
branch
from
9688d1d to
b7104f1
Compare
|
Force-pushed |
|
Automated review:
|
|
|
||
| REPO_DIR = Path(__file__).parent.parent | ||
| sys.path.insert(0, str(Path(__file__).parent)) | ||
| _hc_real = os.path.realpath(__file__) # resolve workspace/src symlink before walking up |
There was a problem hiding this comment.
Automated review: resolving __file__ here fixes REPO_DIR, but _default_memory_dir() below still builds the Codex project slug from Path(__file__) instead of the resolved path. When health-check.py is launched through a symlinked bundle, Path(__file__).parent.parent.resolve() still points at the bundle temp dir rather than the real repo, so the memory probe keeps reading the wrong <claude-home>/projects/<slug>/memory and can still report false missing-memory failures. Please thread _hc_real/REPO_DIR through _default_memory_dir() as well.
|
Automated review: This branch is stacked on unrelated commits, so it is not independently mergeable as a |
|
Automated mergeability review (2026-07-09) Signal: NOT MERGEABLE Current blocker(s):
This is a conservative backlog triage signal. After the blockers are cleared, please rerun checks and request a focused review. |
_default_memory_dir() built the project slug from the unresolved Path(__file__), so a symlinked-bundle launch computed the wrong memory/project dir even after PR fixed REPO_DIR. Trailing .resolve() was insufficient — parent.parent had already climbed out of the real tree. Resolve the symlink first (os.path.realpath) then walk up, matching how REPO_DIR is computed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DFp2p6XUSAQ1eAKKZeiZPt
|
@cla-assistant check |
|
Delta review (8944500): LGTM — |
2 participants
What changed, and why?
`REPO_DIR = Path(file).parent.parent` is correct when health-check.py is invoked directly from the repo root. It breaks when invoked through `workspace/src` — a symlink to the real `src/` (created during M1 migration or app bundling). In that path:
Fix: `.resolve()` before `.parent.parent` canonicalises through the symlink to the real file path, so `.parent.parent` correctly lands at the repo root regardless of invocation context.
Reproducer
```bash
cd workspace && python3 src/health-check.py | grep '\.env'
Before: ✗ .env missing workspace/.env
After: ✓ .env ok 8032 bytes
```
Testing
Both invocation paths produce
✓ .env okafter fix. Pre-existing health-check tests pass. The case-i failure in health-check-notify-slack is pre-existing and unrelated.