`FIX_PROMPT.txt`

40 lines

You are now in FIX mode for this project. Read `CODEX_REVIEW.md` (the review you produced earlier) in this directory. Apply ONLY the SAFE fixes listed below. After fixing, write `CHANGES.md` to this directory documenting what was changed and what was deferred.

WHAT TO FIX AUTONOMOUSLY (SAFE):
1. Hardcoded fallback secrets in source: replace `os.getenv('X', '<actual-secret>')` with `os.getenv('X')` plus a clean fail-fast check. Move the actual secret to `.env.example` (with placeholder) and remove from source. NEVER commit the real secret to a new file. If a `.env` already contains it, leave .env alone.
2. Flask/Express/etc. binding `0.0.0.0` + `debug=True` for tools that are clearly local-only: change to `127.0.0.1` and `debug=False`. If unclear whether public, leave alone and note in CHANGES.md.
3. Hardcoded absolute paths like `/root/.claude/skills/<name>` or `/Users/someone/...` that don't match the project root: replace with `pathlib.Path(__file__).parent` or equivalent.
4. Missing `try/finally` around browser/connection lifecycle that codex flagged: wrap with try/finally.
5. `request.json` or `req.body` with no null-check that returns 500: add a guard returning 400.
6. `innerHTML` with user/server-controlled strings flagged for DOM injection: switch to `textContent` or escape with a tiny helper.
7. CLI passwords passed via argv flagged as visible in `ps`: switch to env var or stdin.
8. Missing dependency lockfile when `requirements.txt`/`package.json` exists but lockfile doesn't: skip (not safe to generate without testing).

WHAT YOU MUST NOT TOUCH (DEFER, DO NOT EDIT):
- Database schema or migrations (any `.sql`, any `migrations/` dir, any code that issues DDL).
- Anything under a `shopify/`, `dw_unified`, or `Designer-Wallcoverings` path.
- DNS configs, Cloudflare configs, nginx configs, certbot, `.well-known/`.
- pm2 ecosystem files, systemd unit files, launchd plists. (Read-only OK.)
- Cron specs (`crontab`, `*.cron`).
- Anything under `node_modules/`, `venv/`, `.venv/`, `dist/`, `build/`, `.next/`.
- Package version bumps (do not run `npm update`, `pip install -U`, etc.).
- Public-facing copy/HTML/CSS that customers see (templates, public/index.html, etc.) — content changes are out of scope.
- Anything that involves rotating real secrets (you do not have access; document in CHANGES.md and leave for Steve).

PROCESS:
1. Read CODEX_REVIEW.md.
2. Walk the P0 list. For each item, decide: APPLY / DEFER. Apply only SAFE items.
3. Walk the P1 list. Apply ONLY items 1–7 from the SAFE list above. Defer everything else.
4. Skip P2 entirely.
5. Write CHANGES.md with two sections:
- `## Applied` — bullet list, each: `file:line — what changed — why`.
- `## Deferred (needs Steve)` — bullet list, each: `severity — file:line — issue — why deferred`.
6. Do NOT run tests, do NOT install packages, do NOT touch git (no commit, no push).
7. If unsure whether a fix is safe, DEFER and document.

CONSTRAINTS:
- Read-only outside the project directory.
- Cap edits at ~10 files unless the same trivial fix applies broadly (e.g., one library used in many places).
- Never invent code — small, surgical patches only.
- Cap CHANGES.md at ~500 words.