fix: portable home dir in /api/ideas/{recent,rejects} (caught by Kimi K2.5)

3853840705c91628786423ff37b3545499727775 · 2026-05-08 00:35:42 -0700 · SteveStudio2

Direct one-shot Kimi audit on the same diff codex-2way reviewed flagged
one issue codex-2way missed: process.env.HOME || /Users/stevestudio2 is
a brittle fallback. On any machine where HOME is unset (and most
non-Steve users), the endpoint quietly read from a non-existent path
or worse a different users directory.

Fix: prefer process.env.HOME, fall back to os.homedir(), then graceful
empty response with a note instead of returning an error.

Both endpoints (replace-all of the two HOME lines) now share the
helper. Smoke confirms /api/ideas/recent + /rejects still serve under
their normal flows.

Cross-validation between two AI auditors (codex-2way + standalone Kimi)
gave us 4 real bugs to fix vs 6 false-positive nits to ignore.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M src/server/index.ts

Diff

commit 3853840705c91628786423ff37b3545499727775
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Fri May 8 00:35:42 2026 -0700

    fix: portable home dir in /api/ideas/{recent,rejects} (caught by Kimi K2.5)
    
    Direct one-shot Kimi audit on the same diff codex-2way reviewed flagged
    one issue codex-2way missed: process.env.HOME || /Users/stevestudio2 is
    a brittle fallback. On any machine where HOME is unset (and most
    non-Steve users), the endpoint quietly read from a non-existent path
    or worse a different users directory.
    
    Fix: prefer process.env.HOME, fall back to os.homedir(), then graceful
    empty response with a note instead of returning an error.
    
    Both endpoints (replace-all of the two HOME lines) now share the
    helper. Smoke confirms /api/ideas/recent + /rejects still serve under
    their normal flows.
    
    Cross-validation between two AI auditors (codex-2way + standalone Kimi)
    gave us 4 real bugs to fix vs 6 false-positive nits to ignore.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/server/index.ts | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/server/index.ts b/src/server/index.ts
index 70fe73c..bfdf3bb 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -273,7 +273,8 @@ app.get('/api/build-status', async (_req, res) => {
     try {
       const fs2 = await import('node:fs/promises');
       const path2 = await import('node:path');
-      const home = process.env.HOME || '/Users/stevestudio2';
+      const home = process.env.HOME || require('os').homedir() || '';
+    if (!home) return res.json({ count: 0, rows: [], note: 'home dir unresolvable' });
       const p = path2.join(home, '.claude', 'skills', 'idea-loop', 'data', 'ideas.jsonl');
       const txt = await fs2.readFile(p, 'utf8');
       ideaCount = txt.split(/\r?\n/).filter(Boolean).length;
@@ -5149,7 +5150,8 @@ app.get('/api/ideas/stats', async (_req, res) => {
   try {
     const fs = await import('node:fs/promises');
     const path = await import('node:path');
-    const home = process.env.HOME || '/Users/stevestudio2';
+    const home = process.env.HOME || require('os').homedir() || '';
+    if (!home) return res.json({ count: 0, rows: [], note: 'home dir unresolvable' });
     const dir = path.join(home, '.claude', 'skills', 'idea-loop', 'data');
     const readJsonl = async (file: string) => {
       try {
@@ -5220,7 +5222,8 @@ app.get('/api/ideas/rejects', async (_req, res) => {
   try {
     const fs = await import('node:fs/promises');
     const path = await import('node:path');
-    const home = process.env.HOME || '/Users/stevestudio2';
+    const home = process.env.HOME || require('os').homedir() || '';
+    if (!home) return res.json({ count: 0, rows: [], note: 'home dir unresolvable' });
     const p = path.join(home, '.claude', 'skills', 'idea-loop', 'data', 'rejects.jsonl');
     let raw = '';
     try { raw = await fs.readFile(p, 'utf8'); }
@@ -5241,7 +5244,8 @@ app.get('/api/ideas/recent', async (_req, res) => {
   try {
     const fs = await import('node:fs/promises');
     const path = await import('node:path');
-    const home = process.env.HOME || '/Users/stevestudio2';
+    const home = process.env.HOME || require('os').homedir() || '';
+    if (!home) return res.json({ count: 0, rows: [], note: 'home dir unresolvable' });
     const jsonlPath = path.join(home, '.claude', 'skills', 'idea-loop', 'data', 'ideas.jsonl');
     let raw = '';
     try { raw = await fs.readFile(jsonlPath, 'utf8'); }

← 1229e88 fix: 3 bugs caught by codex-2way audit at tick 73 · back to Ventura Corridor · fix(coverage): wire JS for rejects drawer (was empty since t be002e1 →