CRCP: harden serve.js — atomic brokers-snapshot write (H3) + clip /api/comps inputs before child-process env (H2)

379ab20efbeb80dedb5726fccabdb0afb64e6c23 · 2026-07-25 11:00:21 -0700 · Steve Abrams

From a code-reviewer sweep; both verified against source. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M scripts/serve.js

Diff

commit 379ab20efbeb80dedb5726fccabdb0afb64e6c23
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat Jul 25 11:00:21 2026 -0700

    CRCP: harden serve.js — atomic brokers-snapshot write (H3) + clip /api/comps inputs before child-process env (H2)
    
    From a code-reviewer sweep; both verified against source. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/serve.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/serve.js b/scripts/serve.js
index aa1859b..8dcb7de 100644
--- a/scripts/serve.js
+++ b/scripts/serve.js
@@ -174,7 +174,7 @@ app.post('/api/contacts/:key/send-draft', async (req, res) => {
 // deps resolve from the browserbase skill's node_modules.
 const { execFile } = require('child_process');
 app.post('/api/comps', (req, res) => {
-  const { city = 'Van Nuys', type = 'Multifamily' } = req.body || {};
+  const _cb = req.body || {}; const _clip = (v, n, d) => String(v == null ? d : v).slice(0, n); const city = _clip(_cb.city, 80, 'Van Nuys'), type = _clip(_cb.type, 40, 'Multifamily');
   const child = execFile('node', [path.join(__dirname, 'live-comps-bb.js')], {
     env: { ...process.env, CC_CITY: city, CC_TYPE: type, NODE_PATH: process.env.HOME + '/.claude/skills/browserbase/node_modules' },
     timeout: 90000, maxBuffer: 2 * 1024 * 1024
@@ -908,7 +908,7 @@ app.post('/api/broker/find-email', async (req, res) => {
           const s = readBrokerSnap();
           if (s) {
             for (const arr of [s.brokers, s.top]) (arr || []).forEach(x => { if (+x.id === bid && !x.email) { x.email = r.found; saved = true; } });
-            if (saved) fs.writeFileSync(path.join(ROOT, 'data', 'brokers-snapshot.json'), JSON.stringify(s));
+            if (saved) { const _sp = path.join(ROOT, 'data', 'brokers-snapshot.json'); fs.writeFileSync(_sp + '.tmp', JSON.stringify(s)); fs.renameSync(_sp + '.tmp', _sp); }
           }
         } catch (_) { saved = false; }
       }

← aeb0028 CRCP: graceful-degrade /api/brokers/linkedin + /api/segments · back to Commercialrealestate · auto-save: 2026-07-25T12:06:06 (2 files) — data/crcp-drift-s 27e17b2 →