Fix sibling-directory path-escape bypass and remove dead code in apply-trivial-patches

d058d904bffd3acd5ccf65d2c309fdd9e266a147 · 2026-05-18 20:14:30 -0700 · SteveStudio2

Files touched

M scripts/apply-trivial-patches.cjs

Diff

commit d058d904bffd3acd5ccf65d2c309fdd9e266a147
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Mon May 18 20:14:30 2026 -0700

    Fix sibling-directory path-escape bypass and remove dead code in apply-trivial-patches
---
 scripts/apply-trivial-patches.cjs | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/scripts/apply-trivial-patches.cjs b/scripts/apply-trivial-patches.cjs
index 5e9fe3a..efcf65f 100755
--- a/scripts/apply-trivial-patches.cjs
+++ b/scripts/apply-trivial-patches.cjs
@@ -16,7 +16,7 @@ const args = Object.fromEntries(
   }, [])
 );
 const DEBATE   = args.debate;
-const PROJECT  = args.project;
+const PROJECT  = args.project ? path.resolve(args.project) : args.project;
 const ITER     = args.iter || '1';
 const MAX_APP  = parseInt(args['max-applied'] || '5', 10);
 
@@ -47,12 +47,6 @@ if (!finalReport.trim()) {
 const patchDir = path.join(PROJECT, '_yolo_patches');
 fs.mkdirSync(patchDir, { recursive: true });
 
-// Snapshot diff before any change so we can show Steve what we touched
-const before = (() => {
-  try { return execFileSync('git', ['rev-parse','HEAD'], { cwd: PROJECT, encoding:'utf8' }).trim(); }
-  catch { return null; }
-})();
-
 // Strict prompt — asks Claude Code CLI for a JSON-only response of trivial patches
 const prompt = `You are reviewing a claude-codex 8-way debate report for a code project.
 Project root: ${PROJECT}
@@ -80,7 +74,7 @@ try {
     '--output-format','text',
     '--allowed-tools','Read,Glob,Grep'
   ], { encoding: 'utf8', maxBuffer: 4*1024*1024, timeout: 6*60*1000 });
-} catch (e) {
+} catch {
   // Fallback path: many machines have `claude` on PATH instead
   try {
     response = execFileSync('claude', [
@@ -115,7 +109,7 @@ let applied = 0;
 for (const p of trivial) {
   try {
     const fp = path.resolve(PROJECT, p.file);
-    if (!fp.startsWith(PROJECT)) { console.log('[apply] path escape, skip:', p.file); continue; }
+    if (fp !== PROJECT && !fp.startsWith(PROJECT + path.sep)) { console.log('[apply] path escape, skip:', p.file); continue; }
     if (!fs.existsSync(fp)) { console.log('[apply] missing:', p.file); continue; }
     const before = fs.readFileSync(fp, 'utf8');
     const occ = before.split(p.search).length - 1;

← f959381 initial snapshot — gitify all builds (CLAUDE.md rule 2026-05 · back to Codex Yolo · Fix smoke-fail revert dropping an unrelated commit (reset to b91246f →